mhtirogla
Home
Systems
API
Pricing
About
Log in
← Back
Home
›
Systems
›
Payments and commerce
digital-wallet
digital wallet with tokenization
Apple Pay
System
Techniques · 3
Primitives · 26
digital-wallet
Payment state machine
finance · medium: Persisted state machine for a payment lifecycle (authorize, capture, void, refund) that treats timeouts as unknown, retries with the same key and applies webhooks idempotently.
›
Envelope encryption
security · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.
›
Hardware security module (HSM)
security · medium: A tamper-resistant device or service that generates keys, signs, decrypts and wraps with them internally, and releases a key only as ciphertext.
›
Idempotency keys
finance · low: Client-chosen unique key per logical operation, stored with a request fingerprint and the final response, so retries replay the first result instead of acting twice.
›
AEAD (AES-GCM, ChaCha20-Poly1305)
security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.
›
Double-entry ledger
finance · low: Append-only journal of transactions whose postings sum to zero per currency; balances are derived, so money can only move, never appear or vanish.
›
Emv cryptograms
finance · low: EMV ARQC/ARPC and tokenized-card cryptograms: session key derivation and MAC verification
Iso 8583 messages
finance · low: ISO 8583 card messages: MTIs, bitmaps, data elements and their encodings
Money representation
finance · low: Store money as integer minor units with an explicit currency exponent, compute in wider integers, and round once with a named rounding mode.
›
Digital signatures (Ed25519)
security · low: Small, fast, deterministic public-key signatures that prove who produced a message; the default for tokens, releases and protocols.
›
ECDH key exchange (X25519, P-256)
security · low: Each side multiplies the other's public curve point by its own scalar and both get the same point; always validate the peer key and run the result through a KDF.
›
Format-preserving encryption
security · low: Encrypt a digit or character string into another string of the same length and alphabet with a keyed Feistel network, reversible with the key and a context tweak, without a lookup table.
›
Hardware backed keystore
security · low: Non-exportable keys in Secure Enclave, StrongBox, TPM: generation, use policies, biometric gating
Mutual TLS
security · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.
›
Passkeys (WebAuthn)
security · low: Phishing-resistant login with a per-site key pair held by the device or password manager; the server stores only a public key.
›
Event sourcing
finance · low: Persist state changes as an append-only stream of immutable events per entity; current state is a fold over them, guarded by expected-version appends.
›
Exponential backoff with jitter
systems · low: Retry after delays that grow geometrically and are randomized, so failed clients spread out instead of hammering a recovering service in synchronized waves.
›
Hierarchical state machine
systems · low: Nest states so a substate inherits its parent's reactions and only overrides what differs, with ordered entry and exit actions along the path.
›
Aes key wrap
security · low: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key material
+ 10 more primitives
System
Techniques · 3
Primitives · 26
digital-wallet
Payment state machine
finance · medium: Persisted state machine for a payment lifecycle (authorize, capture, void, refund) that treats timeouts as unknown, retries with the same key and applies webhooks idempotently.
›
Envelope encryption
security · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.
›
Hardware security module (HSM)
security · medium: A tamper-resistant device or service that generates keys, signs, decrypts and wraps with them internally, and releases a key only as ciphertext.
›
Idempotency keys
finance · low: Client-chosen unique key per logical operation, stored with a request fingerprint and the final response, so retries replay the first result instead of acting twice.
›
AEAD (AES-GCM, ChaCha20-Poly1305)
security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.
›
Double-entry ledger
finance · low: Append-only journal of transactions whose postings sum to zero per currency; balances are derived, so money can only move, never appear or vanish.
›
Emv cryptograms
finance · low: EMV ARQC/ARPC and tokenized-card cryptograms: session key derivation and MAC verification
Iso 8583 messages
finance · low: ISO 8583 card messages: MTIs, bitmaps, data elements and their encodings
Money representation
finance · low: Store money as integer minor units with an explicit currency exponent, compute in wider integers, and round once with a named rounding mode.
›
Digital signatures (Ed25519)
security · low: Small, fast, deterministic public-key signatures that prove who produced a message; the default for tokens, releases and protocols.
›
ECDH key exchange (X25519, P-256)
security · low: Each side multiplies the other's public curve point by its own scalar and both get the same point; always validate the peer key and run the result through a KDF.
›
Format-preserving encryption
security · low: Encrypt a digit or character string into another string of the same length and alphabet with a keyed Feistel network, reversible with the key and a context tweak, without a lookup table.
›
Hardware backed keystore
security · low: Non-exportable keys in Secure Enclave, StrongBox, TPM: generation, use policies, biometric gating
Mutual TLS
security · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.
›
Passkeys (WebAuthn)
security · low: Phishing-resistant login with a per-site key pair held by the device or password manager; the server stores only a public key.
›
Event sourcing
finance · low: Persist state changes as an append-only stream of immutable events per entity; current state is a fold over them, guarded by expected-version appends.
›
Exponential backoff with jitter
systems · low: Retry after delays that grow geometrically and are randomized, so failed clients spread out instead of hammering a recovering service in synchronized waves.
›
Hierarchical state machine
systems · low: Nest states so a substate inherits its parent's reactions and only overrides what differs, with ordered entry and exit actions along the path.
›
Aes key wrap
security · low: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key material
Csprng
security · low: OS-backed cryptographically secure random numbers (getrandom), and when a fast PRNG is not enough
Dual control approval
security · low: Four-eyes / maker-checker approval with quorum policies for sensitive operations
Secure memory zeroization
security · low: Keep secrets in one locked, fixed-size, non-copyable region, erase them with writes the compiler must keep, and exclude them from dumps and swap.
›
Fencing tokens
distributed · low: A number that grows with every lock grant and is checked by the protected resource, so a paused ex-holder's late write is rejected.
›
Leases
distributed · low: A lock that expires on its own: bounded-time ownership that survives crashes and partitions, given bounded clock drift and fencing tokens on writes.
›
Largest remainder rounding
finance · low: Splitting an amount into parts that sum exactly (largest remainder / Hamilton) for allocations, splits and prorations
PRNGs (PCG, xoshiro)
numerics · low: Small, fast, statistically strong non-cryptographic generators: PCG32 and xoshiro256**, with seeding, parallel streams and unbiased ranges.
›
Constant time code
security · low: Writing secret-dependent code without branches or memory lookups on secrets; constant-time compare and select
Cryptographic hashes (SHA-2, BLAKE3)
security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.
›
Optimistic concurrency control
storage · low: Run transactions without locks, record what they read, and validate at commit that nothing changed; fastest when conflicts are rare.
›
Copy for AI
Similar systems
Share the most building blocks with this one.
card-issuing
32 %
card-payments
28 %
payment-gateway
28 %
ach
27 %
realtime-payments
25 %