I've been thinking of ways to store credit cards securely, I thought of this:

  • Take the users credit card info
  • Put the card info in a standard format

"Full Name/Card Num/Security Num/Expiry Date"

  • Then encrypt the data using a 512 bit private key:

Then I'll have something like this:


Then my idea would be to store that encrypted string with the public key in a database.

Then when the user tries to pay for something with their card they just pay like you would with PayPal, but instead of logging in, the user provides their private key.

Would this be useful? Or is there already better alternatives?

I thought of this because even if the database was compromised the credit card data stored within the database would be completely useless, even to the people who run the service.

  • 1
    $\begingroup$ Welcome to Cryptography Stack Exchange. How would a user "provide his private key"? I guess usual users can memorize their credit card data easier than they can memorize a private key. $\endgroup$ Nov 10 '14 at 18:23
  • $\begingroup$ @PaŭloEbermann I was thinking storing it in a cookie on the users computer. If they were to forget it, all they would have to do is enter their credit card again and the software would generate their private key again. $\endgroup$
    – Francis
    Nov 10 '14 at 18:25
  • $\begingroup$ Never, ever store “sensitive” data in browser cookies! $\endgroup$
    – e-sushi
    Nov 10 '14 at 19:03
  • 1
    $\begingroup$ @e-sushi Your right. I'll get the user to keep a copy of their private key somewhere. $\endgroup$
    – Francis
    Nov 10 '14 at 19:11
  • 1
    $\begingroup$ PCI mandates that you never, under any circumstances, store a card's security code. $\endgroup$ Nov 10 '14 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.