Re: [PHP-DB] Credit Card Info & Cryptography
There is a simple alternative that you might not be aware of, and that is use Advantage Database (I am assuming that you are using MySQL right now). You can get a free version to try and it provides encryption at the table level. There is a PHP interface for it and everything can be found at www advantage-database.com and go the the developers download area. I have been using it in my everyday development for about 4 years and I love it. I just recently saw that they offer a PHP interface to it as well as an ODBC, VB, Delphi, C++ Builder, JBuilder etc. Store the credit card info in Advantage and leave the rest of your data where you have it. Just a thought... Jim ---Original Message--- From: Doaldo Navai Junior Date: Wednesday, October 23, 2002 12:52:23 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: [PHP-DB] Credit Card Info & Cryptography Suppose I sell some products online and get user's credit card info via SSL connection. Isn't there any method (free, preferably) of ASSYMETRIC (Public key) cryptography I can use with PHP to store this data in a db?? Or is there any other good option instead of this? TIA, Doaldo -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php .
RE: [PHP-DB] Credit Card Info & Cryptography
How about encrypting the credit card with a secret word that the user chooses? Or obsfucate it by encrypting their credit card using str_rot13(base64_encode(str_rot13($lastname).$lastname.$email.$firstname)) as the key? Sure, if someone gets your code and your DB, those credit card numbers are as good as gone. But what about using a C program, stripped, doing the same thing? That way even if they get your PHP code AND the C program, they won't be able to reverse engineer the code. They can, however, start plugging in strings into the C program (if they have the same system you have, binary compatibility and all) and try those outputted strings on the DB. Let's all agree though: there is no 100% sure way to protect any data if you are going to be able to decrypt it. There are ways, however, to make it tough to do so for the average hacker. I mean, if Hacker A wants your credit cards, you can't keep the key from them. You have to use it somehow to encrypt it, and assuming this happens in the code and not manually, it is located somewhere on your site. If they can get the DB, they can get the key. Obsfucation always worked for me. Peter On Wed, 23 Oct 2002, Aaron Wolski wrote: > Maybe you do, > > Bt I run a _client_dictates_the_development_requirments business. It not > not be that expensive but to some clients who are trying to give it a go > it can mean a lot. > > Am I to tell them I won't accept their business? No - what I am to do is > provide them with the best alternative which is storing the encrypted > credit card info until it has been downloaded then wipe it from the > system. Perfect? Hell no but a solution nonetheless. > > I'm not arguing that we shouldn't be storing credit card info - > encrypted or otherwise - but sometimes life and business just isn't > perfect. I would rather develop a solution like this for them instead of > them going to some hack who could give 2 shits about security. > > My clients dictate the development and I provide the expert and > cautionary advive. If they are willing to be obtuse about the process > then who I am to balk? > > Just my thoughts. > > Aaron > > > P.S. Cheap shot comments like that of yours serve no purpose for > learning here. > > > -Original Message- > From: 1LT John W. Holmes [mailto:holmes072000@;charter.net] > Sent: Wednesday, October 23, 2002 4:41 PM > To: [EMAIL PROTECTED]; 'Ryan Jameson (USA)'; [EMAIL PROTECTED] > Subject: Re: [PHP-DB] Credit Card Info & Cryptography > > > > Well.. Isn't that the ideal. > > > > I agree in theory, however, not all clients are willing to shell for > > the Payment Processor Services if they are just starting ou tin > > e-commerce and don't know what kind of volume to expect. > > They aren't that expensive and usually come with all of the scripts you > need to implement it. > > > Thery is wonderful, however, practicle must preside. > > Hmmm, that's funny. I would think that _security_ must preside. Maybe I > run a different business than you do. > > ---John Holmes... > > > -Original Message- > > From: 1LT John W. Holmes [mailto:holmes072000@;charter.net] > > Sent: Wednesday, October 23, 2002 4:33 PM > > To: Ryan Jameson (USA); [EMAIL PROTECTED] > > Subject: Re: [PHP-DB] Credit Card Info & Cryptography > > > > > > When ever I see "easy", "encrypt", and "credit card" in the same > > sentence, it makes me worry. > > > > Don't store credit card numbers. Charge them once and don't save it > > anywhere. > > > > ---John Holmes... > > > > - Original Message - > > From: "Ryan Jameson (USA)" <[EMAIL PROTECTED]> > > To: <[EMAIL PROTECTED]> > > Sent: Wednesday, October 23, 2002 4:20 PM > > Subject: RE: [PHP-DB] Credit Card Info & Cryptography > > > > > > Since your goal is to encrypt the card number in the database you'll > > naturally need a way to decrypt it as well. At that point it seems > > your concern is that your database will be compromised. That can be > > avoided easily by creating a single private key and using your own > > algorithm to encrypt based on that key. The only catch is, if the code > > > that does the encrypting is compromised, and the database is > > compromised, then the numbers are compromised. My basic point is, your > > > need is not the same as what PGP addresses in that PGP addresses the > > more difficult problem of passing data between 2 entities. Your > > requirement is very simple to address; 1. write a simple compiled > > module with
RE: [PHP-DB] Credit Card Info & Cryptography
:-) You have a good point, I just assumed that decision had already been made. Here's :a visual representation of my point. To hide A by turning it into B using algorithm object C and only someone with key D can see it. C.encrypt(A,D) = B; C.decrypt(B,D) = A; If anyone has either part of C, or D you can consider your data compromised. However, a reasonably complex C and D will result in a B that will not be useful alone. In the case of PGP the encrypt and decrypt algorithms are public, either of which are a good start to breaking the encryption. Hence the considerable increase in complexity of their problem & the need for a more complex solution. Every encryption method by nature boils down to obscurity. What cannot be kept private must be complex enough to provide sufficient security. Hence the name P(retty) G(ood) P(rivacy) ... Which is better, 128 bit encryption or 40? If you answered 128 you are correct, only because it introduces more complexity than the other. Trivia Question: Why WAS it illegal to export strong encryption technology? Answer: Export laws? Technically, but specifically the government wanted the ability to decrypt exported data in a timely fashion. You can believe it... or not. I LOVE PHP!!! <>< Ryan -Original Message- From: 1LT John W. Holmes [mailto:holmes072000@;charter.net] Sent: Wednesday, October 23, 2002 2:33 PM To: Ryan Jameson (USA); [EMAIL PROTECTED] Subject: Re: [PHP-DB] Credit Card Info & Cryptography When ever I see "easy", "encrypt", and "credit card" in the same sentence, it makes me worry. Don't store credit card numbers. Charge them once and don't save it anywhere. ---John Holmes... - Original Message - From: "Ryan Jameson (USA)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, October 23, 2002 4:20 PM Subject: RE: [PHP-DB] Credit Card Info & Cryptography Since your goal is to encrypt the card number in the database you'll naturally need a way to decrypt it as well. At that point it seems your concern is that your database will be compromised. That can be avoided easily by creating a single private key and using your own algorithm to encrypt based on that key. The only catch is, if the code that does the encrypting is compromised, and the database is compromised, then the numbers are compromised. My basic point is, your need is not the same as what PGP addresses in that PGP addresses the more difficult problem of passing data between 2 entities. Your requirement is very simple to address; 1. write a simple compiled module with an embedded key, 2. keep that key in a safe place, and 3. write another module to decrypt, all it needs is the key. This is similar to what was done with DVDs, just don't allow your encryption algorithms to be compromised. You can put the source code in the same place as your key, you can use a code scrambler when you compile, and you should already have your server secure already. Again, my point is, this is easy because the same entity that encrypts is doing the decrypt. Hope this helps. <>< Ryan -Original Message- From: Doaldo Navai Junior [mailto:doaldo@;triunfo-bsb.com.br] Sent: Wednesday, October 23, 2002 12:53 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: [PHP-DB] Credit Card Info & Cryptography Suppose I sell some products online and get user's credit card info via SSL connection. Isn't there any method (free, preferably) of ASSYMETRIC (Public key) cryptography I can use with PHP to store this data in a db?? Or is there any other good option instead of this? TIA, Doaldo -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] Credit Card Info & Cryptography
Maybe you do, Bt I run a _client_dictates_the_development_requirments business. It not not be that expensive but to some clients who are trying to give it a go it can mean a lot. Am I to tell them I won't accept their business? No - what I am to do is provide them with the best alternative which is storing the encrypted credit card info until it has been downloaded then wipe it from the system. Perfect? Hell no but a solution nonetheless. I'm not arguing that we shouldn't be storing credit card info - encrypted or otherwise - but sometimes life and business just isn't perfect. I would rather develop a solution like this for them instead of them going to some hack who could give 2 shits about security. My clients dictate the development and I provide the expert and cautionary advive. If they are willing to be obtuse about the process then who I am to balk? Just my thoughts. Aaron P.S. Cheap shot comments like that of yours serve no purpose for learning here. -Original Message- From: 1LT John W. Holmes [mailto:holmes072000@;charter.net] Sent: Wednesday, October 23, 2002 4:41 PM To: [EMAIL PROTECTED]; 'Ryan Jameson (USA)'; [EMAIL PROTECTED] Subject: Re: [PHP-DB] Credit Card Info & Cryptography > Well.. Isn't that the ideal. > > I agree in theory, however, not all clients are willing to shell for > the Payment Processor Services if they are just starting ou tin > e-commerce and don't know what kind of volume to expect. They aren't that expensive and usually come with all of the scripts you need to implement it. > Thery is wonderful, however, practicle must preside. Hmmm, that's funny. I would think that _security_ must preside. Maybe I run a different business than you do. ---John Holmes... > -Original Message- > From: 1LT John W. Holmes [mailto:holmes072000@;charter.net] > Sent: Wednesday, October 23, 2002 4:33 PM > To: Ryan Jameson (USA); [EMAIL PROTECTED] > Subject: Re: [PHP-DB] Credit Card Info & Cryptography > > > When ever I see "easy", "encrypt", and "credit card" in the same > sentence, it makes me worry. > > Don't store credit card numbers. Charge them once and don't save it > anywhere. > > ---John Holmes... > > ----- Original Message ----- > From: "Ryan Jameson (USA)" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, October 23, 2002 4:20 PM > Subject: RE: [PHP-DB] Credit Card Info & Cryptography > > > Since your goal is to encrypt the card number in the database you'll > naturally need a way to decrypt it as well. At that point it seems > your concern is that your database will be compromised. That can be > avoided easily by creating a single private key and using your own > algorithm to encrypt based on that key. The only catch is, if the code > that does the encrypting is compromised, and the database is > compromised, then the numbers are compromised. My basic point is, your > need is not the same as what PGP addresses in that PGP addresses the > more difficult problem of passing data between 2 entities. Your > requirement is very simple to address; 1. write a simple compiled > module with an embedded key, 2. keep that key in a safe place, and 3. > write another module to decrypt, all it needs is the key. This is > similar to what was done with DVDs, just don't allow your encryption > algorithms to be compromised. You can put the source code in the same > place as your key, you can use a code scrambler when you compile, and > you should already have your server secure already. Again, my point > is, this is easy because the same entity that encrypts is doing the > decrypt. Hope this helps. > > <>< Ryan > > -Original Message- > From: Doaldo Navai Junior [mailto:doaldo@;triunfo-bsb.com.br] > Sent: Wednesday, October 23, 2002 12:53 PM > To: [EMAIL PROTECTED]; [EMAIL PROTECTED] > Subject: [PHP-DB] Credit Card Info & Cryptography > > > Suppose I sell some products online and get user's credit card info > via SSL connection. Isn't there any method (free, preferably) of > ASSYMETRIC (Public > key) cryptography I can use with PHP to store this data in a db?? Or > is there any other good option instead of this? > > TIA, > Doaldo > > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] Credit Card Info & Cryptography
> Well.. Isn't that the ideal. > > I agree in theory, however, not all clients are willing to shell for the > Payment Processor Services if they are just starting ou tin e-commerce > and don't know what kind of volume to expect. They aren't that expensive and usually come with all of the scripts you need to implement it. > Thery is wonderful, however, practicle must preside. Hmmm, that's funny. I would think that _security_ must preside. Maybe I run a different business than you do. ---John Holmes... > -Original Message- > From: 1LT John W. Holmes [mailto:holmes072000@;charter.net] > Sent: Wednesday, October 23, 2002 4:33 PM > To: Ryan Jameson (USA); [EMAIL PROTECTED] > Subject: Re: [PHP-DB] Credit Card Info & Cryptography > > > When ever I see "easy", "encrypt", and "credit card" in the same > sentence, it makes me worry. > > Don't store credit card numbers. Charge them once and don't save it > anywhere. > > ---John Holmes... > > - Original Message - > From: "Ryan Jameson (USA)" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Wednesday, October 23, 2002 4:20 PM > Subject: RE: [PHP-DB] Credit Card Info & Cryptography > > > Since your goal is to encrypt the card number in the database you'll > naturally need a way to decrypt it as well. At that point it seems your > concern is that your database will be compromised. That can be avoided > easily by creating a single private key and using your own algorithm to > encrypt based on that key. The only catch is, if the code that does the > encrypting is compromised, and the database is compromised, then the > numbers are compromised. My basic point is, your need is not the same as > what PGP addresses in that PGP addresses the more difficult problem of > passing data between 2 entities. Your requirement is very simple to > address; 1. write a simple compiled module with an embedded key, 2. keep > that key in a safe place, and 3. write another module to decrypt, all it > needs is the key. This is similar to what was done with DVDs, just don't > allow your encryption algorithms to be compromised. You can put the > source code in the same place as your key, you can use a code scrambler > when you compile, and you should already have your server secure > already. Again, my point is, this is easy because the same entity that > encrypts is doing the decrypt. Hope this helps. > > <>< Ryan > > -Original Message- > From: Doaldo Navai Junior [mailto:doaldo@;triunfo-bsb.com.br] > Sent: Wednesday, October 23, 2002 12:53 PM > To: [EMAIL PROTECTED]; [EMAIL PROTECTED] > Subject: [PHP-DB] Credit Card Info & Cryptography > > > Suppose I sell some products online and get user's credit card info via > SSL connection. Isn't there any method (free, preferably) of ASSYMETRIC > (Public > key) cryptography I can use with PHP to store this data in a db?? Or is > there any other good option instead of this? > > TIA, > Doaldo > > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > > -- > PHP Database Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] Credit Card Info & Cryptography
Well.. Isn't that the ideal. I agree in theory, however, not all clients are willing to shell for the Payment Processor Services if they are just starting ou tin e-commerce and don't know what kind of volume to expect. Thery is wonderful, however, practicle must preside. Aaron -Original Message- From: 1LT John W. Holmes [mailto:holmes072000@;charter.net] Sent: Wednesday, October 23, 2002 4:33 PM To: Ryan Jameson (USA); [EMAIL PROTECTED] Subject: Re: [PHP-DB] Credit Card Info & Cryptography When ever I see "easy", "encrypt", and "credit card" in the same sentence, it makes me worry. Don't store credit card numbers. Charge them once and don't save it anywhere. ---John Holmes... - Original Message - From: "Ryan Jameson (USA)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, October 23, 2002 4:20 PM Subject: RE: [PHP-DB] Credit Card Info & Cryptography Since your goal is to encrypt the card number in the database you'll naturally need a way to decrypt it as well. At that point it seems your concern is that your database will be compromised. That can be avoided easily by creating a single private key and using your own algorithm to encrypt based on that key. The only catch is, if the code that does the encrypting is compromised, and the database is compromised, then the numbers are compromised. My basic point is, your need is not the same as what PGP addresses in that PGP addresses the more difficult problem of passing data between 2 entities. Your requirement is very simple to address; 1. write a simple compiled module with an embedded key, 2. keep that key in a safe place, and 3. write another module to decrypt, all it needs is the key. This is similar to what was done with DVDs, just don't allow your encryption algorithms to be compromised. You can put the source code in the same place as your key, you can use a code scrambler when you compile, and you should already have your server secure already. Again, my point is, this is easy because the same entity that encrypts is doing the decrypt. Hope this helps. <>< Ryan -Original Message- From: Doaldo Navai Junior [mailto:doaldo@;triunfo-bsb.com.br] Sent: Wednesday, October 23, 2002 12:53 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: [PHP-DB] Credit Card Info & Cryptography Suppose I sell some products online and get user's credit card info via SSL connection. Isn't there any method (free, preferably) of ASSYMETRIC (Public key) cryptography I can use with PHP to store this data in a db?? Or is there any other good option instead of this? TIA, Doaldo -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
Re: [PHP-DB] Credit Card Info & Cryptography
When ever I see "easy", "encrypt", and "credit card" in the same sentence, it makes me worry. Don't store credit card numbers. Charge them once and don't save it anywhere. ---John Holmes... - Original Message - From: "Ryan Jameson (USA)" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, October 23, 2002 4:20 PM Subject: RE: [PHP-DB] Credit Card Info & Cryptography Since your goal is to encrypt the card number in the database you'll naturally need a way to decrypt it as well. At that point it seems your concern is that your database will be compromised. That can be avoided easily by creating a single private key and using your own algorithm to encrypt based on that key. The only catch is, if the code that does the encrypting is compromised, and the database is compromised, then the numbers are compromised. My basic point is, your need is not the same as what PGP addresses in that PGP addresses the more difficult problem of passing data between 2 entities. Your requirement is very simple to address; 1. write a simple compiled module with an embedded key, 2. keep that key in a safe place, and 3. write another module to decrypt, all it needs is the key. This is similar to what was done with DVDs, just don't allow your encryption algorithms to be compromised. You can put the source code in the same place as your key, you can use a code scrambler when you compile, and you should already have your server secure already. Again, my point is, this is easy because the same entity that encrypts is doing the decrypt. Hope this helps. <>< Ryan -Original Message- From: Doaldo Navai Junior [mailto:doaldo@;triunfo-bsb.com.br] Sent: Wednesday, October 23, 2002 12:53 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: [PHP-DB] Credit Card Info & Cryptography Suppose I sell some products online and get user's credit card info via SSL connection. Isn't there any method (free, preferably) of ASSYMETRIC (Public key) cryptography I can use with PHP to store this data in a db?? Or is there any other good option instead of this? TIA, Doaldo -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] Credit Card Info & Cryptography
Since your goal is to encrypt the card number in the database you'll naturally need a way to decrypt it as well. At that point it seems your concern is that your database will be compromised. That can be avoided easily by creating a single private key and using your own algorithm to encrypt based on that key. The only catch is, if the code that does the encrypting is compromised, and the database is compromised, then the numbers are compromised. My basic point is, your need is not the same as what PGP addresses in that PGP addresses the more difficult problem of passing data between 2 entities. Your requirement is very simple to address; 1. write a simple compiled module with an embedded key, 2. keep that key in a safe place, and 3. write another module to decrypt, all it needs is the key. This is similar to what was done with DVDs, just don't allow your encryption algorithms to be compromised. You can put the source code in the same place as your key, you can use a code scrambler when you compile, and you should already have your server secure already. Again, my point is, this is easy because the same entity that encrypts is doing the decrypt. Hope this helps. <>< Ryan -Original Message- From: Doaldo Navai Junior [mailto:doaldo@;triunfo-bsb.com.br] Sent: Wednesday, October 23, 2002 12:53 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: [PHP-DB] Credit Card Info & Cryptography Suppose I sell some products online and get user's credit card info via SSL connection. Isn't there any method (free, preferably) of ASSYMETRIC (Public key) cryptography I can use with PHP to store this data in a db?? Or is there any other good option instead of this? TIA, Doaldo -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
RE: [PHP-DB] Credit Card Info & Cryptography
Well... You can use PGPG/GNPGP for this or you can develop your own RSA encryption - if you understand/have the know how. A former programmer of mine who worked for a Security firm developed the base-line code which was originally written in C then transferred into Perl. He was greatful enough to provide us with the code (which is quite small) while working a few site before his departure. Seems to works like a charm and we've never had any issues with it (hacking, etc). Regards, Aaron -Original Message- From: Doaldo Navai Junior [mailto:doaldo@;triunfo-bsb.com.br] Sent: Wednesday, October 23, 2002 2:53 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: [PHP-DB] Credit Card Info & Cryptography Suppose I sell some products online and get user's credit card info via SSL connection. Isn't there any method (free, preferably) of ASSYMETRIC (Public key) cryptography I can use with PHP to store this data in a db?? Or is there any other good option instead of this? TIA, Doaldo -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
