ProblemsCBCModeForPANs - Revision history

Amisra at 18:00, 14 July 2008

2008-07-14T18:00:35Z

Amisra at 17:59, 14 July 2008

2008-07-14T17:59:28Z

Amisra at 17:58, 14 July 2008

2008-07-14T17:58:51Z

Amisra at 17:57, 14 July 2008

2008-07-14T17:57:36Z

Amisra at 17:47, 14 July 2008

2008-07-14T17:47:36Z

Amisra at 17:43, 14 July 2008

2008-07-14T17:43:56Z

Amisra at 17:32, 14 July 2008

2008-07-14T17:32:22Z

Amisra at 17:28, 14 July 2008

2008-07-14T17:28:29Z

Amisra: New page: 1. Abstract * Permanant Account Number (PAN) encryption in an ecommerce merchant databases presents unique application issues. * Block encryption primitives using Ciphe...

2008-07-14T17:27:10Z

New page: 1. Abstract * Permanant Account Number (PAN) encryption in an ecommerce merchant databases presents unique application issues. * Block encryption primitives using Ciphe...

New page

1. Abstract

* Permanant Account Number (PAN) encryption in an ecommerce merchant
databases presents unique application issues.

* Block encryption primitives using Cipher Block Chaining (CBC) mode
preclude the possibility of supporting an efficient lookup
functionality.

* Since CBC encryption mode is not idempotent [8][1] one way hashes for
PANs are needed in order to support lookup.

* The payment community does not view a one way hash of a PAN as a
security violation. Ironicaly, its use is recommended by PCI DSS best
practices.

* On the other hand, security experts categorically proscribe the use of
an idempotent block cipher implementation such as Electronic Code Book
(ECB).

* Storage of SHA1 hashes for payment information follows best practise,
PCI guidelines and buzzword compliance.

* This paper presents a minority opinion and argues that security is
weakened dramatically by employing one way cryptographic primitives
for PANs in order to support lookup.

← Older revision		Revision as of 18:00, 14 July 2008
Line 1:		Line 1:
		+	Link To Document -
	[https://www.owasp.org/index.php/Image:PanEncryption.pdf Problems With Using CBC Mode For PAN Encryption]		[https://www.owasp.org/index.php/Image:PanEncryption.pdf Problems With Using CBC Mode For PAN Encryption]

@@ Line 2: / Line 2: @@
 '''Author Ashok Misra'''
 ''
 Abstract''

@@ Line 1: / Line 1: @@
-[https://www.owasp.org/index.php/Image:PanEncryption.pdf Ashok Misra Problems With Using CBC Mode For PAN Encryption]
+[https://www.owasp.org/index.php/Image:PanEncryption.pdf Problems With Using CBC Mode For PAN Encryption]
-'''Abstract'''
+'''Author Ashok Misra'''
 Permanant Account Number (PAN) encryption in an ecommerce merchant

← Older revision		Revision as of 17:57, 14 July 2008
Line 1:		Line 1:
−	[https://www.owasp.org/index.php/Image:PanEncryption.pdf ~~ProblemsWithCBCModeForPANs~~]	+	[https://www.owasp.org/index.php/Image:PanEncryption.pdf Ashok Misra Problems With Using CBC Mode For PAN Encryption]

	'''Abstract'''		'''Abstract'''

← Older revision		Revision as of 17:43, 14 July 2008
Line 1:		Line 1:
		+	[https://www.owasp.org/index.php/Image:PanEncryption.pdf ProblemsWithCBCModeForPANs]
	Abstract		Abstract

@@ Line 1: / Line 1: @@
-. Abstract
+Abstract
 Permanant Account Number (PAN) encryption in an ecommerce merchant
@@ Line 8: / Line 8: @@
 functionality.
-Since CBC encryption mode is not idempotent [8][1] one way hashes for
+Since CBC encryption mode is not idempotent, one way hashes for
 PANs are needed in order to support lookup.

@@ Line 1: / Line 1: @@
 . Abstract
-     * Permanant Account Number (PAN) encryption in an ecommerce merchant
+Permanant Account Number (PAN) encryption in an ecommerce merchant
-       databases presents unique application issues.
+databases presents unique application issues.
-     * Block encryption primitives using Cipher Block Chaining (CBC) mode
+Block encryption primitives using Cipher Block Chaining (CBC) mode
-       preclude the possibility of supporting an efficient lookup
+preclude the possibility of supporting an efficient lookup
-       functionality.
+functionality.
-     * Since CBC encryption mode is not idempotent [8][1] one way hashes for
+Since CBC encryption mode is not idempotent [8][1] one way hashes for
-       PANs are needed in order to support lookup.
+PANs are needed in order to support lookup.
-     * The payment community does not view a one way hash of a PAN as a
+The payment community does not view a one way hash of a PAN as a
-       security violation. Ironicaly, its use is recommended by PCI DSS best
+security violation. Ironicaly, its use is recommended by PCI DSS best
-       practices.
+practices.
-     * On the other hand, security experts categorically proscribe the use of
+On the other hand, security experts categorically proscribe the use of
-       an idempotent block cipher implementation such as Electronic Code Book
+an idempotent block cipher implementation such as Electronic Code Book
-       (ECB).
+(ECB).
-     * Storage of SHA1 hashes for payment information follows best practise,
+Storage of SHA1 hashes for payment information follows best practise,
-       PCI guidelines and buzzword compliance.
+PCI guidelines and buzzword compliance.
-     * This paper presents a minority opinion and argues that security is
+This paper presents a minority opinion and argues that security is
-       weakened dramatically by employing one way cryptographic primitives
+weakened dramatically by employing one way cryptographic primitives
-       for PANs in order to support lookup.
+for PANs in order to support lookup.