l0ve2hat3 Posted April 14, 2009 Share Posted April 14, 2009 what is the best way to store sensitive data in a mysql db using PHP.... i dont need a hash i need encryption.. is something like this ok? function encrypt($text,$key){ return trim(base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $key, $text, MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND)))); } function decrypt($text,$key){ return trim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, base64_decode($text), MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND))); } if so... where is the best place to keep the key? Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/ Share on other sites More sharing options...
PFMaBiSmAd Posted April 14, 2009 Share Posted April 14, 2009 Define: "sensitive data." What exactly are you planning on storing and are you on a shared web/database server or do you have dedicated servers? Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/#findComment-810016 Share on other sites More sharing options...
l0ve2hat3 Posted April 14, 2009 Author Share Posted April 14, 2009 ss# or cc#'s Yes this is a dedicated web/database server Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/#findComment-810018 Share on other sites More sharing options...
l0ve2hat3 Posted April 14, 2009 Author Share Posted April 14, 2009 anyone? Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/#findComment-810036 Share on other sites More sharing options...
Daniel0 Posted April 14, 2009 Share Posted April 14, 2009 ss# or cc#'s I hope you have a good lawyer and a lot of money. Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/#findComment-810043 Share on other sites More sharing options...
l0ve2hat3 Posted April 14, 2009 Author Share Posted April 14, 2009 ok sooo... wrong forum? some other advice?? store first 12 characters? can anyone point me in some sort of direction? major companies do it... Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/#findComment-810047 Share on other sites More sharing options...
Daniel0 Posted April 14, 2009 Share Posted April 14, 2009 Yeah, and major companies have good lawyers and a lot of money. Anyway, here you go: https://www.pcisecuritystandards.org/security_standards/download.html?id=pci_dss_v1-2.pdf Why do you need to store it anyway? You're just asking for trouble. Might as well let the well renowned payment gateways do it. Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/#findComment-810048 Share on other sites More sharing options...
PFMaBiSmAd Posted April 14, 2009 Share Posted April 14, 2009 Are your servers in a secured location where the only people that have physical access to them are specific employees of yours that you trust (not the cleaning crew) and where the only administrative access is through a local terminal that is equally secured? If so, then you might have a chance of satisfying your agreement with your merchant account provider. Your agreement with your CC processor will specify where, how, and with what level of security and encryption you may store CC numbers electronically without violating that agreement. It would be much better, easier, and less costly to arrange for such information to only be stored in the merchant account provider's secure servers. Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/#findComment-810059 Share on other sites More sharing options...
ToonMariner Posted April 14, 2009 Share Posted April 14, 2009 be careful nesting encryption like that - it can lead to th eprobability of MORE collisions rather than less. personally encrypt using mysql's AES_ENCRYPT DES_ENCRYPT. this is do in a class and the file that class is in is encoded with ion cube so the keys I use wouldn't be instantly available should someone get hold of that file. get notification if that file has been accessed or ftp or what ever - by the time they have decoded the file you should have updated your key and the fields dependant on it... the cost of security is eternal vigilance!!!!!! Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/#findComment-810066 Share on other sites More sharing options...
l0ve2hat3 Posted April 14, 2009 Author Share Posted April 14, 2009 ah thank you all! thats the kinda feed back im used to on this forum! welll after looking over the pci standards... i will not be storing cc numbers Quote Link to comment https://forums.phpfreaks.com/topic/154095-storing-sensitive-data/#findComment-810081 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.