5

I am using a payment gateway in my app.
I'm thinking of storing credit card numbers without the CVC numbers in my app.

Storing the CC number eliminates the requirement of re-entering the CC number. However, the user must still enter the CVC number.
The CC number itself will be encrypted with AES and a user defined key.

Questions:

  1. Is it secure to store credit card data in an App this way?
  2. How secure is this implementation in Android versus other OSes?
  • 1
    How are you going to store the key? – Black Magic May 9 '16 at 12:30
  • 2
    What does "user defined key" mean exactly? Will the user have to enter a password on every launch? Or is the key defined on first run and then stored somewhere? (If yes, where?) – marstato May 9 '16 at 13:11
  • 3
    Your app will need to be PCI compliant: pcicomplianceguide.org/pci-faqs-2 – Virtual Anomaly May 9 '16 at 13:13
  • 1
    pcicomplianceguide.org/… – ForguesR May 9 '16 at 14:34
  • 1
    PCI considerations aside, I wouldn't encrypt it with AES or any other symmetric encryption scheme if it will be stored on the user's device. If you instead encrypt it using RSA with a sufficiently long key (2048 bit or longer), and leave the private key on the server doing the payment processing then it will be a bit harder for anyone to decrypt the account number if the device is compromized, stolen, or lost. – KristoferA May 12 '16 at 7:32
3
  1. It is as secure as the place where you store the CC encrypting key.
  2. Android features a keystore, which handles key generation, storage and usage for you. Your app talks to it via the KeyChain API. It offers some advantages:
    • Each app can only access their own keys. The keystore enforces this for you.
    • Key material is protected in case of app process compromise.
    • It performs all the crypto for you.
    • If the device features some piece of secure hardware, key material can be stored there, so that it is hard to extract it from the device.

Reference to Android keystore is informative only. Using it won't necessarily make you neither secure nor PCI-DSS compliant. Others have posted references for that.

| improve this answer | |
  • what would make it compliant for use-cases? – Shritam Bhowmick May 9 '16 at 15:49
2

You can read the PCI standards here:

https://www.pcisecuritystandards.org/document_library

First of all find the regulations your app needs to follow, then check out specific cryptography / implementation related recommendations regarding CC data storage. They provide way more details than what we cound gather here.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.