Kryptronic Software Support Forum

I'll try that, I think it should work ok for what I need.

I guess the major security concern is that if the same key is used for encrypting all credit cards then if a hacker found that key he'd have access to decrypting all credit card numbers, where right now with each key being unique for each transaction there is no reference for anyone to use to decrypt those keys unless they have a copy of every single email containing the decrypt keys.

I guess if I wanted to maintain a tight wrap on security for what I'm wanting I could mod the code to allow for key encryption where I'd have an encryption key and decryption key, then store the decryption key on a seperate system so if someone was to gain access to the web server they'd have no reference to the decryption key, and you could make all decryption processes take place on the remote box which would be behind the firewall.

Then you could do key rotation to make things even more fun.

Hi All,

I found the topic  related to making 1 encryption key. I've tested out the code and like the ability to use only one key. I have some questions though.

When I modify the adm_track.pl file any orders completed prior to the mod don't have a link to decrypt and don't show the cc number. If I don't change this file, the orders completed after the fix don't decrypt properly.

Is it possible to still require an admin to input the key to retreive the cc number so both old orders with variable encryption keys can be used, and all orders going forward can be decrypted with the static key?

Thanks in advance,
cab

That's a good point. I didn't even realize it was missing. Since the CVV number is only sent in the encryption email how do you get to all 3 pieces of information? CC#, Expiration Date, and CVV while allowing for only one encryption key?

Thanks for pointing that out.

cab