-1

Possible Duplicate:
Storing credit card details

I am creating a website for a client that has a registration system that the user will provide credit card information i have read about so it will be reviewed by the admin of the website just for once then it will be deleted so i would like to know what are the best techniques to encrypt the credit card information

Community
  • 1
  • 1
Mohamed Hassan
  • 1,579
  • 4
  • 19
  • 35
  • 3
    Best practice is to **NOT** store the information. At most the last 4 digits and card type. – Marc B Jul 19 '12 at 15:46

1 Answers1

4

Have a look at PCI DSS and PA-DSS requirements. You'll have to deal a lot with key management procedures. It's not only about encrypting and storing the PAN.

Look at what PCI DSS describes as "strong cryptography".

citation: Cryptography based on industry-tested and accepted algorithms, along with strong key lengths and proper key-management practices. Cryptography is a method to protect data and includes both encryption (which is reversible) and hashing (which is not reversible, or “one way”). Examples of industry-tested and accepted standards and algorithms for encryption include AES (128 bits and higher), TDES (minimum double-length keys), RSA (1024 bits and higher), ECC (160 bits and higher), and ElGamal (1024 bits and higher). See NIST Special Publication 800-57 (www.csrc.nist.gov/publications/) for more information.

mdo
  • 6,961
  • 3
  • 24
  • 26