21

Any body have an idea about this ... !! What can we do in Magento 1.9.x versions.
Authorize developer refferaral url

Authorize.Net is phasing out the MD5 based transHash element in favor of the SHA-512 based transHashSHA2. The setting in the Merchant Interface which controls the MD5 Hash option will be removed by the end of January 2019, and the transHash element will stop returning values at a later date to be determined.

Thanks in advance

Improve this question
3

2 Answers 2

Reset to default
1

Solution: Check out the latest update with patches from the Magento site regarding this issue: https://support.magento.com/hc/en-us/articles/360024368392 This solves the issue! For community editions download the patch from https://magento.com/tech-resources/download for magento 1 check for Authorize.net Direct Post Signature Key patch in Release Archive and for version 2 in Magento Open Source Patches - 2.x

Authorize.Net phases out MD5 based hashes used for transaction response verification. Phase 1 means that merchants are no longer able to configure or update their MD5 Hash settings in the Merchant Interface. This will have severe impacts on merchants who use or are interested in using the Authorize.Net Direct Post method in Magento. So if you are not using Authorize.Net Direct Post method in magento you don't have to worry.

If you want to fix the directpost method you will have to do redo the hash calculation with the new APISignatureKey :

 $hash_data  = "^" .$merchantApiLogin . "^" . $transactionId . "^" . $amount."^" ;
 $local_hash = hash_hmac("sha512", $hash_data, pack("H*", $APISignatureKey));

and then the hash validation with transHashSHA2 instead of x_MD5_Hash.

Improve this answer
6
  • is there affect on auth.net (AIM) ?
    – Dhaval Vaghela
    Mar 8, 2019 at 6:03
  • AIM method is deprecated. There's an upgrade guide. The Api method should be used developer.authorize.net/api/upgrade_guide
    – GERIKO
    Mar 13, 2019 at 7:14
  • In magento only the Authorize.net Direct Post is affected.
    – GERIKO
    Mar 13, 2019 at 7:59
  • Yes AIM (Advanced Integration Method) is also affected. The authorize article says that the MD5 hash in the AIM method will be replaced with an SHA2 hash.
    – GERIKO
    Mar 13, 2019 at 8:06
  • Thanks for sharing this but in magento auth.net ( AIM ) method has not used md5 code anywhere. so is need to update anything in magento AIM ?
    – Dhaval Vaghela
    Mar 13, 2019 at 9:51
0

The end of life for MD5 Hash will be done in two phases:

Phase 1 - Remove ability to configured/update MD5 Hash setting in the Merchant Interface. This feature will be removed in the coming weeks by end of January 2019/early February 2019. This change has no impact to the API response, that will be done in Phase 2.

Phase 2 - Stop sending the MD5 Hash data element in the API response. The date for this change will be announced at a later time but is expected in the next 2-3 months.

For more details check this https://support.authorize.net/s/article/MD5-Hash-End-of-Life-Signature-Key-Replacement

Improve this answer
1
  • 1
    Thanks for the detailed response, but are there any implications in Magento 1.9?
    – Samyer
    Jan 24, 2019 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.