We're developing a web application in which certain not logged users (clients) need to send their credit card details to other users (merchants) - which, we'll assume, are PCI compliant.
We are looking into getting PCI compliance, but the process will surely needs a lot of time. Therefore we are investigating other solutions which don't require us getting a certification and protect us from getting sensible data stolen.
Our plan is to:
- Make the merchant generate a private and a public key
- Store the private key inside his browser using localstorage (and provide a mean to backup it)
- Provide the public key on the form used by a client
- Before the client send the data, encrypt everything with the merchant public key
- Store the encrypted data in our server
- Provide the encrypted data to the merchant
- Make the merchant decrypt the data in his browser using his private key
Do you see security issues in this workflow? Do you think we still need PCI compliance when employing a system like that? The reasoning is that, for anyone without the private key, those are just random bytes.
The only attack I can think of is someone compromising the server and replacing a merchant public key with his own key. But he could as well steal a token for another payment gateway and fake the communication needed to do something nasty.
We know about services like Paymill, Braintree and Stripe (which offer pretty good client side libraries) but they're not fitting for our solution (or better: they're alternative we'll make available for merchants - but it should be up to them to decide).
Thank you in advance
EDIT: I totally agree with you guys and I'd rather work with thirdy party solutions.
The problem is that we're working in a market in which most of our competitors are small companies working without PCI compliance (and most of them even without HTTPS!!). Our competitors simply receive CC data, store them and give access to the users.
We know about the risks of such approach, but the users don't and they prefer their solutions to ours because they'd rather have the whole CC data, instead of just having buttons to execute actions.