Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many merchants offer to save credit card info in an encrypted form for faster checkouts from their store in the future. How is it that merchants can store this information in an encrypted format and still be able to decrypt it to plain text later?

share|improve this question
up vote 7 down vote accepted

I think you are confusing encryption with hashing because hashing is one way whereas encryption is two-way providing you have the proper key to decrypt whatever is encrypted.

Short answer is: they are storing the key somewhere (in a hopefully secure location). Whenever they need to decrypt the credit card number they hand the encrypted data to a module that looks up the key, decrypts the card number, and returns the card number to the payment system.

share|improve this answer
Hopefully they are padding the data with some noise as credit card data is short and the format is well known. It is too much to hope for some type of CBC CFB or IV as this would impeed parallel decryption of individual card info. – this.josh Nov 22 '11 at 8:50
@the.josh as a credit card number is 16 digits long, lets Assume that they were using a block cipher like AES and that the credit card is just 8 bit (1 byte) ansi characters. That's 16*8 == 128 bits which happens to be the block size of AES in the first place so nomatter the block cipher mode it's going to end up a single block. – ewanm89 Nov 22 '11 at 9:37
so, the only hope is to get doing IV's right. – ewanm89 Nov 22 '11 at 9:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.