I am currently writing a payment system to accept payment details from an NFC enabled smartphone (BlackBerry 9900) to a Windows client (C#.NET)
I am currently having two issues relating to security:
What is a good way to secure the data for transmission over NFC? I'm thinking public key encryption so that it can be encrypted on the phone using the public key and then decrypted by the .NET on the other side using the private key.
How to secure the data so that the data can't be cloned by another reader i.e. another reader pretends the be the windows client and reads the secure data. This could then be played back to the windows client by the attacker at a later data to make a payment. I'm thinking that when the phone taps the client reader the client will send a token that must be present in the data returned from the phone that includes the sensitive data. I think that maybe the public and private keys should be created per each transaction request. The public key sent to the phone to encrypt the data. Maybe that would suffice as the token also as if it can't be decrypted by the client then it's an invalid request.
Please note that I have no experience in cryptography at all. I'm aiming to implement a solution that has libraries readily available in .NET 3.0 and BlackBerry SDK 7.0.