InnoDB?

[Nifty Hat Mitch]

> Thank you for the reply. I understand the reasoning behind your
> response. My company and I were thinking about storing the numbers
> permanently but I guess that will not be a good idea. There is a
> firewall being deployed also. However, I do see the point.
> 
> >Can I safely store multiple customer credit card numbers in a table
> that is InnoDB, if I use an Encrypt()
....
> No. The Encrypt function is too weak. AES_Encrypt/AES_Decrypt or 
> DES_Encrypt/DES_Decrypt are stronger. However I would strongly recommend
> that credit card numbers not be permanently stored in the table.


One way to think about storing multiple customer credit card numbers
is to consider them as a liability or perhaps toxic waste.  An
individual like me may be off the hook with my credit card company if
my account number is stolen once.  However your company may not be off
the hook if thousands of account numbers are released to an
international crime group should you be hacked or a trusted employee
turn bad.

Such data also needs 'meta' data associated with it.  Invoice number,
customer ID, Date/Time, paid/pending, timer for return policy and so on.
There are also some accounting standards that must be adhered to.

Any encryption will have a key.  Some design process needs to exist to
re-encrypt the data should you find that the key is at risk or discover
that the algorithm is hackable.  Then there is the issue of
backups....


-- 
	T o m  M i t c h e l l 
	May your cup runneth over with goodness and mercy
	and may your buffers never overflow.