10 ms·
"For the techies who are wondering, the encryption on the credit card information is 4096 bit RSA." Why would they be using RSA to encrypt fields in an interna
by sweis 13y ago
"For the techies who are wondering, the encryption on the credit card information is 4096 bit RSA."
Why would they be using RSA to encrypt fields in an internal database, rather than a symmetric algorithm?
If they really did use RSA, I'd wager they did not pad it correctly and don't have any authentication.
- tbrownaw 13y agoIt's a Write-Only Memory. The web server can write the credit card info to the database, but isn't able to read (and decrypt) that same info in case it gets hacked. Presumably there is another machine that only does billing and has a much smaller attack surface, which is the only online place with the key to decrypt the card info.
- sweis 13y agoI've seen web frontends that encrypt submitted credit card info with a public key, then had billing backends that re-encrypted with a symmetric key (usually in a HSM). That was strictly for performance overhead and key rotation flexibility. Perhaps name.com didn't care about that.
- kcen 13y agoThat way you can safely put your public key on all of your application servers so that any node can write data, but only allowed nodes can read.