0

I am reviewing the code for a product our team developed where credit card information is stored in a local database. This database can be accessed in the event of no internet connection. I came across the encryption methods.

The developer who wrote this portion of our code encrypted AES over RABBIT over AES. I have seen implementations with AES over AES (same concept I suppose as Triple DES) but I've never seen or researched stacking block over stream. I don't know if the results from this are going to be consistent (i.e. without data corruption) or secure.

I would assume they would be because I assume stacking encryption with different keys can never be less secure than one time encryption. Below is a sample of the code I found.

function classSecureMessage(message){
	this.secretA=security.randomAlphaNum(56);
	this.secretB=security.randomAlphaNum(56);
	this.secretC=security.randomAlphaNum(56);
	var passStr=message;
	passStr=CryptoJS.AES.encrypt(passStr, this.secretA);
	passStr=CryptoJS.Rabbit.encrypt(passStr.toString(), this.secretB);
	passStr=CryptoJS.AES.encrypt(passStr.toString(), this.secretC);
	this.message=passStr;	
	this.decrypt= function(){
		var passStr=CryptoJS.AES.decrypt(this.message, this.secretC).toString( CryptoJS.enc.Utf8 );
		passStr=CryptoJS.Rabbit.decrypt(passStr, this.secretB).toString( CryptoJS.enc.Utf8 );
		passStr=CryptoJS.AES.decrypt(passStr, this.secretA).toString( CryptoJS.enc.Utf8 );
		return(passStr);
	}
}

EDIT: To add the performance of this is not horrible. it takes 0.012 seconds to encrypt and decrypt credit card data.

16
  • That kind of solution might get your company out of business and make a lot of people unhappy. It's forbidden to store credit card information if you are to be a VISA or Mastercard merchant. Oct 31, 2015 at 7:13
  • 1
    @DarkWander It is not forbidden to store credit card information. But you will have to be PCI certified .. Oct 31, 2015 at 7:21
  • @DarkWanderer No there guidelines specifically state that credit card information if stored must be encrypted with a "strong" cryptographic algorithm to meet or exceed the standards set forth in AES128. and in no condition can the entire track data be stored. This is standard procedures for nearly every POS system on the market to take the information and store it when it is unable to process it immediately.
    – PC3TJ
    Oct 31, 2015 at 7:21
  • @EbbeM.Pedersen we are fully PCI compliant, been audited by firstData(our preffered gateway service) and have had 3rd party PCI Compliance and Risk Assesments performed.
    – PC3TJ
    Oct 31, 2015 at 7:23
  • Okay, I stand corrected. I do hope the secrets are stored in different locations then (as AES over AES can only make sense then) Oct 31, 2015 at 7:24

1 Answer 1

1

I can see a reference to having a block-stream-block cypher here, which mentions Bruce Schneier's book Applied Cryptography.

I've never seen stacking of the same cypher as (as it says on the link) the idea is that each party trusts a different cypher... so there's no added security in stacking AES over AES, except in the case of a brute force attack.

I would swap one of the AES cyphers with another block cypher, so in the case that one of the 2 ciphers is compromised, your data will still be secure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.