4

I have been playing around with the Credit cards (saved) payment option and noticed it encrypts the credit card numbers. What algorithm is it using? What are the specifics? I quite interested to see what method they are using.

Note: I am not going to use the Credit card (saved) payment option on my live site. I understand it is a huge security issue. I am just curious about how strong of encryption it uses!

  • 1
    Check out app/code/core/Mage/Core/Model/Encryption.php. The encrypt function there looks to be what's called when it saves credit card information. It also references lib/Varien/Crypt, but I'm certainly no expert at deciphering this stuff and how good it is. – Don Aug 13 '14 at 19:31
7

According to Magento:

Strong Data Encryption, Hashing and Key Management Strong data encryption based on AES-256 and strong hashing based on SHA-256. Database keys are easily managed and updated.

From my understanding and some quick glances at code:

Community is mainly Mcrypt and Blowfish (ECB Mode) based, as Don pointed out in the comments.

Enterprise uses a custom class for PCI compliance which uses both Mcrypt and Blowfish as with different cyphers and stronger encryption.

MCRYPT_RIJNDAEL_128,MCRYPT_RIJNDAEL_256,HASH_VERSION_SHA256,etc.

Both using a combination of MD5, salting and hashes.

You can override the encryption models if you wished to use your own:

 /**
 * @return Mage_Core_Model_Encryption
 */
public function getEncryptor()
{
    if ($this->_encryptor === null) {
        $encryptionModel = (string)Mage::getConfig()->getNode(self::XML_PATH_ENCRYPTION_MODEL);
        if ($encryptionModel) {
            $this->_encryptor = new $encryptionModel;
        } else {
            $this->_encryptor = Mage::getModel('core/encryption');
        }

        $this->_encryptor->setHelper($this);
    }
    return $this->_encryptor;
}

With that said, storing Credit Card data makes you a target and future legal issues possibly.

However I have seen scrapping hacks that are capturing data input before it is encrypted and logging it. So simply not storing them makes you immune either. This is proof that other exploits outside of Magento in its stack should always be considered.

As far as encryption strength, that would be a better question for:

Other related documents to read:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.