I need to send credit-card numbers and other information through SFTP. What considerations should I have? Recommendations? Is valid encrypt this numbers? What does PCI say about this?

  • 1
    Hello and welcome to Information Security! I am not sure I understand all of the question. Could you clarify this part: "Is valid encrypt this numbers?" – Anders Apr 11 '17 at 14:59
  • Are you talking a batch of credit numbers in some sort of file? Is this a regular import / export process or a one of transfer? Are they full numbers or masked? What is the other info? Are you talking card holder, expiry, cv2? – iainpb Apr 11 '17 at 15:41
  • Is a diary transfer of files. In this file have a some data of persons and a full numbers of credit-cards, without cv2, masked or any type of encryption. – gonisimchuk Apr 11 '17 at 17:24
  • PCI say "4.1 Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks. ". In this case, thorugh SFTS is used SSH. This right? Is necessary other type of control? – gonisimchuk Apr 11 '17 at 17:30
  • yes, ssh and thus "sftp" would seem to meet your criteria. – dandavis Apr 11 '17 at 19:28

Regardless the file transfer protocol, I would recommend encrypting files before sending them out. You may use for example pgp encryption, it can be automated.


Since you are using SFTP, there must be some certificate associate with it(which gives us all the information about the validity and level of security/encryption). Mainly there are two things you should check for such operation.

1) The credibility of the certification authority(Who has issued the certificate). Sometimes self signed certificates are also used.Accept such certificates only if you trust the issuer.

2) The encryption technique and key-length used for encryption. Make sure the encryption technique is not obsolete(RSA is the most common and widely used these days) and the key is long enough to make it hard for anyone to crack it(2048 will be good).

  • 3
    SFTP does not use certificates (it does not rely on SSL/TLS), however the second point is a valid one. – WhiteWinterWolf Jul 18 '17 at 8:20
  • 3
    SFTP uses host keys instead of certificates, and host keys don't use a central trusted authority. You need to make sure the sending machine already knows the host key of the receiving machine (and you've verified that it's correct), or you could fall for a man-in-the-middle attack. – dogoncouch Jul 18 '17 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.