Topic: Storing Credit Card Numbers in MySQL

Hello,

I just want to throw this topic out there.

I am building an application that will be storing credit card numbers in a MySQL database. I have been doing some research into it and have read about using MySQL's AES_ENCRYPT and AES_DECRYPT methods using a keystring to encrypt and decrypt the credit card number.

Does anyone have any better ideas using Ruby?

I don't necessarily want to discuss the question of "Do I" or "Don't I" store the data - just the technical aspect of the best way to encrypt a piece of sensitive data in a database.

Thanks,
Chris

Re: Storing Credit Card Numbers in MySQL

Hi,

One thing you'll have to be careful of is Ruby/Rails displaying sensative information in plain text in the log files, e.g. passwords, now you can block that out - but that doesn't mean that it is encrypted, it's just not visible to human eyes!

Then I'd be looking at my design/data model and look into the various encryption routines that you could employ at the various MVC layers.

Finally you should allways be using HTTPS - but you probably are fully aware of this - to accept this kind of sensative information.

Steve.

Re: Storing Credit Card Numbers in MySQL

Thanks Steve. Yes, always using HTTPS is crucial.

Great point about the logs.

If the logs show things like "INSERT" calls to MySQL with all the data visible, it

Re: Storing Credit Card Numbers in MySQL

I dug up Crypt and OpenSSL Cipher. I tried them both. They seem to do the trick. Crypt is pure Ruby based, they said it isn't as fast as OpenSSL. I think I'll start developing with OpenSSL.

Does anyone have know of any red flags with OpenSSL::Cipher?

Thanks,
Chris

Re: Storing Credit Card Numbers in MySQL

Ignition wrote:

That brings up another question. When encrypting your data, where do you store the key-string used when encrypting?

Thanks,
Chris

Hi chris,

Usually in a HSM (Host Security Module) - probably something that will be out of the "average web applicaton", in terms of price & support. But I would expect that the 3rd party payment acquirers, e.g. Worldpay, Paypal, would have these so they can encrypt before passing on to the payment schemes, i.e. VISA, MasterCard.

I think for the typical web application I would recommend storing your crypto keys in a seperate d/base, that uses a seperate account that has read only access and if possible not on the same server.

Hope this helps,

Steve.

Re: Storing Credit Card Numbers in MySQL

Thanks Steve.

Chris