EC-PAY: An Efficient and Secure ECC-Based Wireless Local Payment Scheme

Local payment transactions may enable people to walk into a store and purchase items by just pressing a button on their mobile phone. While a mobile device acting as a replacement for the wallet would be desirable there are several security concerns that arise when turning to practical implementations. Indeed, local wireless communication technologies such as Bluetooth, IrDA, WiFi are designed with arguable compromises between usability and security. In this paper we examine such issues and present a novel scheme (EC-PAY) for local payment transactions to be deployed in the realm of a PKI infrastructure. The first working prototype is based on the Bluetooth protocol stack and exhibits among others some enhanced features such as ease of use (allowing futuristic options such as "automatic payment" with no actions required by the user) and efficiency (by making heavy use of elliptic curve based cryptographic primitives). To gain more confidence in the security of the scheme as a composite, a modular approach was taken in its design using secure cryptographic primitives as building blocks. In particular, to overcome recently uncovered vulnerabilities in Bluetooth based systems a standard compliant key agreement scheme is used