> Enabling the pass-through of data was a key use case we were trying to enable. Exactly. However, what if the processor issued a certificate per merchant specifically for this case? i.e. The subject of the cert is the merchant origin but the chain is to the processor and only the processor has the private keys. > Allowing keys is a problem as anyone could have inserted that key into the payload. I guess this is the fundamental question. Is this a problem? The channel is assumed to be secure (TLS) so really all we are doing here is giving the merchant a way to remove themselves from scope and pass the card details around in unsecure (non-PCI compliant) systems. Are those systems out of PCI scope if they generate the payment request and therefor provide the encryption key? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/w3c/webpayments-crypto/issues/15#issuecomment-394611001
Received on Tuesday, 5 June 2018 07:34:10 UTC