special cc# encryption module

This message was sent from: Suggestions and Proposals
http://forums.oscommerce.com/viewtopic.php?p=193406#193406
----------------------------------------------------------------

If I had the technical skills to do this I would do it myself, so if anyone fancies a challenge or a nice favour I would appreciate it big time:

The following are two modules to encrypt and decrypt cc# details for merchants who prefer to process the orders via their credit card terminal provided by their banks:

1) http://www.oscommerce.com/community/contributions,611

This uses a GPG public key to encrypt the middle 8 digits before sending it to a merchants email address. (you need to download 0.92 - not just 0.94). The merchant decrypts this data on their personal computer via their private key and processes the order manually.

2) http://www.oscommerce.com/community/contributions,1148

This is similar in that it encrypts and decrypts the cc# numbers, but it does this by encrypting the cc# numbers to the database and decrypting the cc# numbers to the clients browser, once the client has sucessfully logged in the the admin section. This contribution has more features than the one above (cvv, cc blacklist etc.). However, I perceive it to be less secure than the GPG version (I may be wrong here).


However, what I do think is that a combination of the two modules would be an awesomely module and very secure.

For instance, the second contribution is used as the base point. It stores the cc# details encrypted in the database and reveals the decrypted cc# numbers to the client who has logged in, BUT the middle 8 digits are XXXXXXXX out.

These middle 8 digits are sent to the GPG module and encrypted before being sent to the merchants email address.

In other words the best of both words. Not only are the middle 8 digits encrypted and sent by email to the users computer who has the private key but the rest of the numbers are also encrypted in the database and revealed only to the person who has successfully logged in.

What do other users think?

CMR