using m2crypto to encrypt credit card numbers

[John La Rooy]

Whatever you use to identify the credit card number has to be guaranteed to
be unique for each card number. A hash won't give you that. Perhaps you could
use public key encryption. Encrypt the keys right away on the internet connected
machine using a key pair. The private key is kept on a separate system and
can recover the credit card numbers from the cipher. 

Every purchase made with the card will encrypt the number to the same ciphertext
which you use to identify that card everywhere in your database.

The machine with the private key need not be connected to the internet at all
if you don't mind using sneakernet to transport the transactions to it. 

John

On Tue, 11 Jun 2002 15:12:00 -0500
"Mark McEahern" <marklists at mceahern.com> wrote:

> [Graham Ashton]
> > I've not followed the thread, but I'm assuming that your problem is that
> > you don't want to store the card number in plain text, and that if you
> > encrypt and store it in a manner that will allow automatic decryption by
> > your software, then a cracker who gains access to your servers will be
> > able to decrypt the card numbers with ease.
> 
> That's it precisely.
> 
> > The only sensible solution to this that I've ever thought of involves
> > getting the payment processor (i.e. online transaction processing
> > company) to store a hash for each of your customers' credit cards.
> 
> I should have mentioned that solutions which involve getting the payment
> processor to do anything different are simply not an option.  As far as I
> can tell, I either store the credit card number or I can't do recurring
> billing.  If you know of any payment processors that support recurring
> billing, please share them.
> 
> > Consequently you wouldn't need to store the card number at all, just the
> > encrypted hash. Job's a good'un; card numbers would be nicked from far
> > fewer online web sites with shoddy security.
> 
> Also, another reason I need to store the credit card number is in the case
> of chargebacks, which don't go through the payment processor--rather, they
> go through the bank.  I don't fully understand this part, but I do believe I
> need the credit card number in order to link the chargeback to a
> transaction.
> 
> Thanks for your comments,
> 
> // mark
> 
> -
> 
> 
>