Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Security > storing credit card information

Reply
Thread Tools

storing credit card information

 
 
yawnmoth
Guest
Posts: n/a
 
      07-02-2008
My first question is... does the PCI require retail stores store
credit card numbers? <http://www.darkreading.com/document.asp?
doc_id=135602> suggests that they are. If so, what does the PCI say
about storing them encrypted vs. storing them unencrypted?

I can see virtue to both, actually.

If you store credit card numbers encrypted or hashed, it's a lot
harder for the database administrator to get ahold of every customers
credit card.

The problem with with encryption / hashing is that... say a customer
wanted to search for invoices by their credit card number. If the
credit cards were stored unencrypted, a customer could give just the
last four digits of the credit card number out and with them, a search
could be made. Just do something like...

SELECT * FROM invoices WHERE credit_card_num LIKE '%xxxx';

The point-of-sale system could do that, via SSL/TLS, and get the
invoices without ever disclosing the full credit card number to the
phone receptionist or cashier or whomever (although I imagine a
cashier would probably be swiping the physical card in some sort of
magnetic strip reader).

If credit card numbers, in contrast, were stored encrypted or hashed,
that probably wouldn't work. If you were using a block cipher with a
block size of 4 and were in ECB mode, you could do the search (just
encrypt the last four digits with the key and plug the result into the
LIKE query), but if the block size wasn't 4 or if you were in CBC
mode... at that point, you'd be out-of-luck.

So it does seem that both techniques have their virtues.

Of course, it seems to me that the virtue of encrypting far outweighs
the virtue of not encrypting. A single database administrator having
access to everything can do a ton more damage than a phone
receptionist who's just been given a single credit card number
(assuming you even have phone receptions).
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
I collect credit card information author&producer@prevent_identy_theft.com DVD Video 3 08-09-2005 05:25 PM
Storing credit card numbers on hosted website. John ASP .Net 5 12-15-2004 07:11 PM
DVD Pacific: customer credit-card information hacked Douglas Bailey DVD Video 1 08-18-2004 12:06 PM
Re: Credit Card Information R Green - WoWsat.com Computer Security 0 08-30-2003 04:45 AM



Advertisments