topic Google Pay Direct Integration Rotation of keys in cybersource APIs

Google Pay Direct Integration Rotation of keys

Gaulke121 — Tue, 26 Apr 2022 11:27:05 GMT

I am trying to implement the Google Pay using direct integration and in the google docs it is mentioned that merchants have to manually rotate the keys. During rotation it is mentioned that Caution: You must support the old private key for decryption of payment methods for eight days after you remove the old public key.

Does this mean I need to support old private key even after deleting the old public key?

I found out that Google uses Elliptic Curve Digital Signature which is asymmetric. As far as I know in case of asymmetric algorithms only one key pair will be involved (public and private). Why does Google recommend to support old private key up to 8 days?

H and R Block

Re: Google Pay Direct Integration Rotation of keys

Xamaaa — Sat, 30 Apr 2022 12:06:01 GMT

The workflow is the following:

Define/upload a new key pair (recommended annually)

Support both New and old keys during decryption

 String decryptedMessage =
  new PaymentMethodTokenRecipient.Builder()
     .addRecipientPrivateKey(newPrivateKey)
     .addRecipientPrivateKey(oldPrivateKey);

remove old key

This is a common approach as the platform might require some time to propagate the new keys and make sure the old ones are no longer used. You need to support the old key deploying the code above (supporting both signatures) for some time (at least 8 days according to Google's note) and ideally

confirm that the old public key is no longer used to encrypt any transactions.

Re: Google Pay Direct Integration Rotation of keys

JamesZimmerman — Wed, 04 May 2022 12:37:09 GMT

Well it would be nice to have a choice instead of having to bring my wallet and cards in case I have to use a browser based payment system like every venue in my country has now since the pandemic. It's not that much of a big deal but it would be nice to have similar functionality as other browsers.

Re: Google Pay Direct Integration Rotation of keys

Tonny_Robins — Mon, 20 Jun 2022 10:55:01 GMT

This is a typical methodology as the stage would demand an investment to spread the new keys and ensure the old ones are not generally utilized. You want to help the old key conveying the code above (supporting the two marks) for quite a while (something like 8 days as indicated by Google's note) and preferably

Re: Google Pay Direct Integration Rotation of keys

Tonny_Robins — Wed, 20 Jul 2022 14:36:25 GMT

It isn't so a very remarkable serious deal however having comparable usefulness as different browsers would be great.