> I need to use a public/private key encryption system for dredit card
> details on a site I am developing. We are not taking Credit Card payments
> with an online marchanmt such as NetBanx Sec Pay, etc, etc, but we need to
> send the CC details to the Shop Management for putting through a PDQ
> machine.
This is a really silly thing to do. Honest. You can find *SOME* way to do
it online cheaper, easier, and faster with far, far less headaches...
> How can I use a Public Private key system to do this from PHP. I
> know Java can support RSA (although never investigated it), and that PHP
can
> use standard Java classes (is this true?).
That said, I'm going to tell you how to do it, so you can hang yourself if
you really want to... <Deity> knows why, when this is such a Bad Idea
<tm>...
You don't really need to involve Java at all...
Use http://gnupg.org
Create your keypair on a non-networked machine.
Text-export only the *PUBLIC* half of the key-pair and sneaker-net it to the
web-server.
Make the keyring readable by "nobody" (or whomever PHP runs as).
Use http://php.net/popen to execute gpg and get your encrypted data.
Put the PRIVATE half on a *VERY* physically secure machine that *ONLY*
people you trust can access. You probably should have a separate machine
just for this, with an email address used *ONLY* for these orders. Put the
private key half on this machine, along with gpg to decode it.
You *ALSO* need to have procedures and policies in place to safely get the
data from the decrypted email to the PDQ and then *DESTROYED* without any
risk of somebody else seeing the cc#s. Very, very difficult in any
real-world situation.
*MOST* credit card fraud comes from retail workers snarfing card numbers
from pocketed carbons. Now you're just making it easy for them.
If you like spending money for some reason (and you must if you're doing
things this way) you could use PGP instead.
--
WARNING [EMAIL PROTECTED] address is an endangered species -- Use
[EMAIL PROTECTED]
Wanna help me out? Like Music? Buy a CD: http://l-i-e.com/artists.htm
Volunteer a little time: http://chatmusic.com/volunteer.htm
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
