I have an application where a user buys "gift card pins". Once they have completed their purchase, we, as a broker, buy the pins from a 3rd party and need to deliver them to the end user.
Once we have the pins, we need to upload them for the user to be able to use like a normal card. Due to needing this being sensitive data but at the same time, data that needs to be eventually shown to the end user, I am stuck on a best approach here.
I need to store these codes securely but at the same time, be able to decode them as the end user needs to see the code to user on merchant XYZ's website.
The application uses PHP's CodeIgniter framework which has a built in encryption library.
The pin is then encrypted and stored in the MySQL DB and can be retrieved with:
The issue with this, from a security standpoint is that the PHP application has the encryption key stored within it so that it can run these methods.
I don't think I can use hashing in this situation as I need to eventually know the true value of the data.
Any suggestions on an approach for this?