A younger user needing some help - WTLS

Hi,

I am a brazilian needing some help to graduate in my University. I´m inteended in desenvolve a WAP site where you can buy movie tickets using your credit card number. But for this purpose, I need to transmit the datas using assimetric criptography (WTLS).

Will I write my wap page using WML? how will I implement wtls on it. I create the field to put user and passworld, per example, but how will I criptography it in the phone with a known public key?

Can you help me?

I think i understood how it works. Firstly, I need to have a server running SSL. And in the WML file, in the form action, I just redirect it to https://wap.domain.com/index2.wml. Is this?

Is the ssl program that will generate the key pair? Everything alone?

It looks like easier than i thought.

lol - famous last words

http://www.telcopay.com - why do all the hard work yourself?

It´s my final project in my graduate. And I can´t pay anything. That´s why I need to do the hard work.

But about my question? Am I in the right way?

I'm not sure if all phones can support https / ssl as the secure credit card side of things that we've used has been outsourced to Telco Pay so I can't offer any real advice on that.

The thing with doing cards online is you're going to need something like an account with ProTX to actually handle the transactions, a merchant account to be able to take cards in the first place and you'll need to be able to handle the encryption of the card data and processing of the HTTP posts to find out if the card if authorised or declined.

The other way of doing this that jumps to mind would be to do it with reverse billed text messages and bill the user that way, then they could be send a digital entry ticket on the phone, something like an image or a text with a reference number the cinema can use to verify the ticket is valid.

As for the SSL side of this you will need to get your server to generate a CSR key which you use when you get the SSL certificate installed, this can either be done through SSH or through control panels depending on what setup you have. That at least covers the SSL side of things though the card data will still need some kind of encryption like Crypt::CBC / Crypt::Blowfish for Perl or libmcrypt, mhash, mcrypt for PHP.

What you have to ask yourself as the developer is "is this secure enough for me to put my card details through it?"

Hope this helps.