The secure connection is not
necessarily required, since we have the secrets
and
.
If we have a secure link between the customer and the merchant,
the transaction id t also can be used as a shared secret.
If we are to consider adopting this scheme into existing systems,
it is during this money transfer stage that we would overlay our mechanisms.
There is usually an intermediate credit card company and the merchant's bank
between the customer's bank and the merchant. Transaction clearing is
done via this path.
There are two typical authentication systems for clearing:
one uses signature mechanisms between banks and credit card companies,
the other uses secret key mechanisms between them.
In both cases, such an infrastructure is already used for banks and
credit card companies, but merchants and customers are not in their
network. If they extend the infrastructure to all customers and merchants,
the cost will be enormous and such extension may not be straightforward.
If our scheme is adopted within their infrastructure,
no additional investment is needed.