CODEWITHSUNDEEP
c#.netsqlencryptioncredit-card
But I'm Not A Wrapper Class
But I'm Not A Wrapper Class

Reputation: 14286

Storing encrypted credit card numbers in a SQL database

I was wondering what the best approach is to store encrypted credit card numbers in a SQL database for C# (.net framework). Should I do it manually by using String/SecureString/Byte Array with some sort of symmetric encryption?

I heard that for an alternative (and probably the easier option), a service provider (which you place the transaction with) will give you a key that can be used to retrieve transaction information. I don't know how to go about this approach, but is this the better option? I want the most safest and most secure option. I want to be PCI compliant as well.

Upvotes: 2

Views: 8083

Answers (2)

Bobson
Bobson

Reputation: 13706

Update: In the three years since I wrote this answer, I've learned more about PCI, and a newer spec has been released. While the information below is not wrong, step 1 puts you in PCI scope at the "D for Merchants" level, which is the most onerous.

The better way to handle this is to not touch the card data yourself. Either you use a form provided by your processor which sends them the data, or you just redirect to them (like with PayPal). Both options can put you at the "A" or "A-EP" levels, which are much easier to certify.

Either way, you would still receive a token, which is safe to store, so steps 3 and 4 are still applicable.

Original Answer:

I heard that for an alternative (and probably the easier option), a service provider (which you place the transaction with) will give you a key that can be used to retrieve transaction information.

This is true. Basically, the process is:

  1. Get credit card information from customer / user. Store in in-code variable (i.e. not a file, or a log, or a database).
  2. Send credit card information to your processor (such as Authorize.NET, Payware, Paypal, etc).
  3. Receive a response which includes a "token" of some sort. This is the way you identify this particular transaction for future communications with the processor.
  4. Store the token into your database. Encryption would be nice, but not necessary, since the token simply refers to "Transaction #12345", and has no sensitive information by itself.

Upvotes: 3

Eric Leschinski
Eric Leschinski

Reputation: 154003

If you are going to store credit card numbers in a database you control, read the PCI DSS:

http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard

Why should you comply:

https://www.pcisecuritystandards.org/security_standards/why_comply.php

Then read how to convince the people who asked you to store credit cards in house the world of hurt you are bringing upon yourselves to do this:

https://security.stackexchange.com/questions/18677/how-to-convince-coworkers-to-not-store-credit-card-numbers-ourselves

Upvotes: 4

Related Questions