I have been playing around with the Credit cards (saved) payment option and noticed it encrypts the credit card numbers. What algorithm is it using? What are the specifics? I quite interested to see what method they are using.
Note: I am not going to use the Credit card (saved) payment option on my live site. I understand it is a huge security issue. I am just curious about how strong of encryption it uses!
According to Magento:
Strong Data Encryption, Hashing and Key Management Strong data encryption based on AES-256 and strong hashing based on SHA-256. Database keys are easily managed and updated.
From my understanding and some quick glances at code:
Community is mainly Mcrypt and Blowfish (ECB Mode) based, as Don pointed out in the comments.
Enterprise uses a custom class for PCI compliance which uses both Mcrypt and Blowfish as with different cyphers and stronger encryption.
MCRYPT_RIJNDAEL_128,MCRYPT_RIJNDAEL_256,HASH_VERSION_SHA256,etc.
Both using a combination of MD5, salting and hashes.
You can override the encryption models if you wished to use your own:
/**
* @return Mage_Core_Model_Encryption
*/
public function getEncryptor()
{
if ($this->_encryptor === null) {
$encryptionModel = (string)Mage::getConfig()->getNode(self::XML_PATH_ENCRYPTION_MODEL);
if ($encryptionModel) {
$this->_encryptor = new $encryptionModel;
} else {
$this->_encryptor = Mage::getModel('core/encryption');
}
$this->_encryptor->setHelper($this);
}
return $this->_encryptor;
}
With that said, storing Credit Card data makes you a target and future legal issues possibly.
However I have seen scrapping hacks that are capturing data input before it is encrypted and logging it. So simply not storing them makes you immune either. This is proof that other exploits outside of Magento in its stack should always be considered.
As far as encryption strength, that would be a better question for:
Other related documents to read:
app/code/core/Mage/Core/Model/Encryption.php. Theencryptfunction there looks to be what's called when it saves credit card information. It also referenceslib/Varien/Crypt, but I'm certainly no expert at deciphering this stuff and how good it is.