Best encrypt Algorithm to use

[pooch398]

We have a e-commerce store that needs to store credit card numbers for a few of
its customers. I know that the best solution is to not store the numbers at all
and this is our default option, however there are few stores that need this
information for shipping, etc. We are using the encrypt function in cf8 and
were wondering which algorithm would be best for this case.

[byron1021]

Alternative to storing CCs is to do reference transactions if your payment
gateway supports these types of transactions. This would be where you do a
authorization only on the card for a very small amount. If the return is
successful, subsequent charges to the credit card can be done just using the
authorization and/or transaction #, usually up to the expiration of the CC on
the original charge. Alot of vendors, even ones that do subscription based
services are moving to this model. And at some point I would say the industry
will require this. PayFlowPro supports this.

Other than that I would recommend Triple DES since this would be 2 way
encryption, then use some sort of salting to make it a bit harder to decrypt if
someone gets the raw data. Something like encrypt CC+secret key, then
encrypted value+secret key 2, encrypt+order total. Keep the 2 keys in
different locations.

Keep the keys, salting scheme and data in different, minimize the access level
to the bare minimum. Also don't keep code and the encrypted data on the same
server, and they should if possible be firewalled off from each other with
minimum access.

[MaryJo]

I would agree with Byron that you really should look for other ways to do this.
You should be sure to review the PCI Compliance regulations for storing card
data....what is required is very extensive and requires more than most small
merchants can afford to do. For instance, you can't just use CF
encryption....the encryption key itself needs to be encrypted (key encryption
key) and that has to be saved somewhere apart from the web server (typically a
separate appliance is used). The security policies that must be in place and
the hardware needed to fulfill PCI compliance at this level is quite extensive.
Be really careful about doing this kind of thing in terms of protecting your
own interests as well, because you don't want to get stuck with a lawsuit when
the merchant gets fined by their bank for failing to comply. Should there be a
breach and card data stolen, fines can be quite hefty.