-
CCProtect (encrypt and decrypt cc's)
Hi,
I made a two way encryption system to store credit cards securely. It can be used to encrypt everything but is made for credit cards. Alot is to confuse the hell out of a potential hacker and avoid decryption. It has 3 encoding layers and 2 encryption layers plus the structure is also confusing as seven heaven. The salt is stored in the final result but even with the encryption salt it's hard to decode it. I calculated that it's around 1: Quadrillion chance to crack it, so pretty secure. It can also encrypt arrays (converts to JSON).
The only downside right now is that it increases the string size by 400x (400%)
What do you guys think?
Script: #8267823 - Pastie
PHP Code:
<?php
class CCProtect {
private function pekkaEncode($s) {
$out = '';
for ($i=0;$i<strlen($s); $i++) {
$out .= sprintf("%03d", ord($s[$i]));
}
return $out;
}
private function pekkaDecode($s) {
$out = '';
for ($i=0;$i<strlen($s);$i+=3) {
$out .= chr($s[$i].$s[$i+1].$s[$i+2]);
}
return $out;
}
private function generateRandomString($length = 10) {
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$randomString = '';
for($i = 0; $i < $length; $i++) {
$randomString .= $characters[rand(0, strlen($characters) - 1)];
}
return $randomString;
}
private function mCrypt($text, $salt) {
return trim(base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($salt), $text, MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND))));
}
private function mDecrypt($text, $salt) {
return trim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($salt), base64_decode($text), MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND)));
}
public function encrypt($content) {
$response = array(
0 => rand(1000, 9999),
1 => rand(1000, 9999),
2 => rand(1000, 9999),
3 => rand(1000, 9999),
4 => rand(1000, 9999),
5 => rand(1000, 9999),
6 => rand(1000, 9999),
7 => rand(1000, 9999),
8 => rand(1000, 9999),
9 => rand(1000, 9999),
10 => rand(0, 9),
11 => rand(0, 9),
12 => rand(0, 9),
13 => rand(0, 9),
14 => rand(5, 9),
15 => '',
16 => '',
17 => '',
18 => '',
19 => '',
20 => '',
21 => '',
22 => '',
23 => '',
24 => '',
25 => '',
);
$rand = rand(10, 14);
$combination = str_split($response[$response[$rand]], 1);
$password = $response[$combination[0]] . $response[$combination[1]] . $response[$combination[2]] . $response[$combination[3]];
if(is_array($content)) {
$content = json_encode($content);
}
$content_length = strlen($content);
$content_field = rand(20, 25);
$store_content_field = 10 + $response[14];
for($i=15; $i <= 19; $i++) {
if($i == $store_content_field) {
$response[$i] = $this->mCrypt($content_field, $password);
} else {
$response[$i] = $this->mCrypt(rand(10, 99), $password);
}
}
for($i=20; $i <= 25; $i++) {
if($i == $content_field) {
$response[$i] = $this->mCrypt($content, $password);
} else {
$response[$i] = $this->mCrypt($this->generateRandomString($content_length), $password);
}
}
$json = json_encode($response);
$string = $password . $this->pekkaEncode(str_rot13(convert_uuencode($json)));
$string = str_split($string, 4);
$string = implode(' ', $string);
return trim($string);
}
public function decrypt($string) {
$string = str_replace(' ', '', $string);
$password = substr($string, 0, 16);
$decoded = json_decode(convert_uudecode(str_rot13($this->pekkaDecode(substr($string, 16)))));
return trim($this->mDecrypt($decoded[$this->mDecrypt($decoded[10 + $decoded[14]], $password)], $password));
}
}
$protection = new CCProtect;
$cc = array(
'firstname' => 'Krista',
'lastname' => 'Sheppard',
'dob' => 'August 11, 1932',
'cardnumber' => '4916 5210 7061 9044',
'cvv2' => '769',
'expire' => array(
'month' => '6',
'year' => '2015',
),
);
echo chunk_split($protection->encrypt($cc), 75);
Example of a credit card encrypted:
Code:
7650 7650 5508 9101 0900 5407 0052 0720 4403 5064 0890 4505 1044 0710 4603
4067 0700 4505 1096 0710 4303 5081 0750 4605 1048 0890 4505 1044 0750 4403
4067 0740 4508 0052 0670 4303 5060 0710 4503 5052 0890 4405 1040 0720 4406
9067 0760 4405 1096 0680 1009 0043 0350 5607 2045 0510 8108 9044 0340 6707
1043 0350 9608 9045 0500 6707 4043 0340 4007 2062 0520 9206 8046 0510 5303
5052 0830 8208 1056 0830 9308 6060 0350 8204 5057 0700 4107 1062 0340 9005
5060 0510 8205 1060 0740 6105 5010 0900 6208 3049 0740 5808 2056 0700 4903
8093 0460 4507 4040 0730 5305 3067 0660 4805 1071 0790 4303 4041 0510 5205
1060 0720 5808 1093 0370 4808 0061 0410 5307 1082 0400 5408 0061 0540 5607
4049 0650 5007 4045 0420 4508 3076 0840 1009 0060 0530 3703 8044 0390 6108
9056 0710 4007 1048 0520 7207 5056 0510 5708 0051 0530 4503 7047 0500 4008
9040 0840 3307 6045 0520 9308 2057 0380 5708 9054 0820 4508 1060 0520 9308
0051 0840 4807 0051 0540 6107 2048 0530 5303 3010 0900 5108 1093 0700 5703
6086 0520 4805 1033 0800 5308 1064 0730 5705 1041 0810 6108 3045 0400 5907
2036 0930 4007 9067 0790 5108 1060 0760 6005 1037 0550 4808 2082 0810 5208
4057 0710 6007 1057 0680 4507 2081 0740 5607 3086 0350 1009 0050 0540 8107
0054 0360 7806 0043 0700 4906 9051 0370 6706 6057 0810 8603 8061 0730 4508
3057 0810 6006 9057 0700 6007 1047 0500 4008 9040 0820 4507 2048 0540 8204
0053 0720 5308 5052 0720 4408 8045 0830 4007 4057 0390 8603 6010 0900 5807
1037 0340 4505 1041 0880 6107 2037 0820 6205 2049 0510 4408 2082 0330 5905
1049 0440 5605 5052 0880 5805 5053 0860 5105 2071 0930 4007 9067 0790 4407
3053 0780 5703 6076 0500 5803 7064 0740 5105 1045 0380 4805 4041 0690 1009
0044 0540 4503 8050 0820 5305 5052 0550 6108 0044 0350 7806 5054 0820 5703
5060 0820 8207 0056 0520 7107 6061 0710 7204 0051 0360 4007 5061 0530 3304
9060 0390 3706 5053 0840 5307 7059 0830 7207 0061 0830 6804 2051 0360 9308
4010 0900 4403 8064 0700 5608 3041 0810 6105 2090 0370 5703 6082 0850 4603
6089 0730 5307 2053 0500 5203 6053 0730 5007 1061 0370 4507 3053 0520 5108
2045 0880 4207 2086 0350 6107 0053 0790 5105 1033 0740 4408 0060 0680 4207
1060 0720 1009 0050 0550 3308 0060 0840 8204 2046 0360 9207 4060 0720 3709
0059 0710 6103 6050 0390 6105 4046 0540 6804 9044 0810 4108 3054 0520 8607
9052 0830 8604 9060 0520 6407 5052 0730 7205 6059 0540 7205 4051 0360 8603
3056 0740 4106 7010 0900 6103 5056 0880 4405 1033 0820 5007 2037 0890 5708
3057 0860 4507 2037 0780 5807 1072 0880 4907 1057 0760 4503 6076 0820 6205
2089 0670 4808 2057 0870 5707 2061 0440 5005 5082 0780 5908 2037 0330 5408
1037 0900 5407 9090 0410 1009 0059 0360 4508 0059 0720 6706 6049 0710 7604
9054 0360 7206 6044 0740 5607 2062 0800 3308 7059 0810 3609 3047 0500 4008
9040 0820 3706 9061 0390 4105 4053 0830 8506 9044 0520 4903 4048 0540 7106
7062 0830 7805 8045 0530 5304 5010 0900 4405 3049 0800 5005 2093 0860 5305
2041 0880 4808 4086 0420 5208 1061 0660 4907 4057 0860 4908 4086 0780 4403
6061 0700 4603 6049 0860 5605 2092 0710 5103 9033 0750 4207 2033 0760 5405
5053 0760 5703 9056 0760 5607 2052 0680 1009 0052 0510 4906 0043 0720 4906
9060 0360 8605 5057 0740 4908 3058 0820 4105 8060 0520 9303 6062 0390 7804
5045 0370 8205 8059 0700 5305 6055 0340 9304 8056 0730 4103 9053 0840 5707
7044 0520 4905 2050 0710 9308 8059 0800 5607 0010 0900 5003 6082 0520 5105
1052 0750 4507 0037 0900 5705 5086 0340 5003 5045 0740 6007 3048 0710 6105
4072 0360 4903 8093 0460 4507 3061 0430 4603 6085 0750 4907 4057 0450 5608
4045 0500 6105 4093 0380 4503 7048 0740 5905 3057 0850 1009 0061 0520 3706
7058 0380 4807 2057 0810 7806 8053 0730 6103 4058 0730 6007 3051 0510 8106
7056 0730 7208 8050 0380 9307 8044 0540 4907 8059 0360 6805 6056 0800 4906
0043 0710 9003 8052 0530 4108 8049 0380 5207 2052 0510 5305 4010 0900 5208
1049 0530 4403 8036 0740 5807 1093 0660 5108 4082 0360 5205 1081 0710 4503
6036 0930 4705 0040 0890 4008 3037 0480 6008 0081 0690 4603 8052 0680 4505
2045 0480 4605 1045 0880 5207 2078 0680 6008 2061 0760 5805 2057 0750 1009
0053 0720 4108 6044 0380 4105 5049 0710 5705 2045 0340 8906 7045 0720 8107
4055 0340 9304 8052 0550 4908 7061 0530 8207 1051 0830 9303 6057 0830 5303
4059 0350 3708 6058 0370 4508 5050 0700 3305 5051 0530 6105 1060 0830 6808
3010 0900 5208 0041 0890 5908 4078 0580 4805 5037 0850 5503 4093 0460 5703
7033 0790 4605 5045 0840 5805 1061 0550 5907 4086 0780 5008 2033 0870 4905
4078 0740 5203 8068 0810 5008 4078 0730 5605 2053 0760 5107 0045 0660 4207
1076 0330 1009 0044 0370 3704 6060 0530 8206 0043 0710 8607 3053 0830 4904
5056 0510 4508 0058 0730 9308 7053 0810 3704 3051 0540 4508 7053 0800 5607
6044 0700 8204 4054 0540 6108 0058 0520 7807 2056 0820 7807 3059 0510 7805
2049 0720 4407 3010 0900 5305 5082 0660 4403 5033 0560 4903 6064 0750 6203
8072 0790 6208 3041 0790 5503 4092 0670 5605 4045 0700 4508 3053 0490 5307
3061 0820 4907 3061 0680 6103 9096 0740 5305 2085 0690 5908 4057 0530 4505
1056 0730 5808 1053 0450 1009 0051 0700 9607 4053 0520 6107 3045 0380 9007
9044 0520 4807 4046 0350 3708 4047 0510 7107 9043 0340 4007 4050 0510 7808
8050 0810 4503 9061 0830 7608 0044 0710 9007 8045 0530 8607 7045 0810 6106
8057 0740 5305 7052 0550 4108 6010 0900 4503 6049 0330 6103 8068 0350 5503
4093 0420 6203 5037 0450 4805 4053 0360 4507 2033 0760 6108 3072 0530 4805
1078 0600 4307 1053 0400 5707 2082 0730 5708 1090 0680 5008 3057 0380 4907
0049 0360 5305 5037 0830 4605 2052 0680 1009 0051 0740 5206 8051 0810 9008
0054 0830 7608 7053 0820 6706 6045 0810 8608 1055 0340 9307 0057 0820 8607
1062 0550 5703 4048 0830 7604 0045 0810 9004 9059 0820 8206 5045 0820 4907
2060 0810 9005 0058 0530 6103 3045 0540 3606 8010 0900 6105 2075 0730 4508
4053 0680 5403 8089 0700 4508 1078 0480 6103 6090 0790 5605 4037 0330 6005
2072 0550 5203 8037 0470 5903 5041 0670 5003 9037 0380 5705 3056 0880 6105
4090 0540 4508 4052 0740 5503 4093 0540 5605 1049 0850 1009 0050 0820 7807
8052 0520 7808 1057 0370 4507 4060 0360 4504 9050 0390 4407 6053 0390 5307
7058 0380 6103 6058 0830 7208 0060 0840 8205 2045 0520 8605 8046 0360 8608
8052 0700 7805 4058 0510 4507 3058 0520 7807 1046 0520 7606 5010 0900 6208
0049 0840 6005 3041 0800 4405 1041 0770 6005 4093 0420 5805 3036 0930 4705
0040 0890 4008 1072 0470 4507 1078 0760 5003 8068 0450 5203 8044 0670 4605
3041 0400 4905 4045 0880 5907 4033 0900 5703 6041 0770 4907 2082 0580 1009
0044 0520 7208 2056 0520 8203 8046 0550 4905 7046 0350 6104 9049 0370 8204
1054 0530 7808 7051 0520 6007 3061 0740 4107 3060 0810 4507 1062 0520 4107
4049 0360 9005 0057 0360 4506 7057 0550 8603 3049 0710 7605 8060 0390 5705
1010 0900 5805 2041 0660 4807 2033 0850 4903 6078 0690 5903 9061 0730 4605
2082 0500 4905 3053 0520 5903 8045 0770 6103 7052 0740 5008 2045 0770 5405
4064 0750 6205 1078 0420 5705 2057 0550 4505 4045 0450 5003 6068 0430 5408
0057 0890 1009 0048 0830 5304 1051 0810 9004 3044 0550 4505 6053 0840 5207
4052 0550 3706 7060 0820 3704 5058 0510 4006 7053 0730 4505 3051 0830 6103
7044 0730 7605 1044 0740 8206 7060 0810 7606 9044 0710 5607 2056 0800 6106
9060 0530 8205 2010 0900 4907 0064 0720 5405 2078 0340 5705 4093 0400 4808
4041 0740 5908 3044 0750 5908 3068 0860 5408 4033 0730 4603 5033 0670 5005
2082 0900 5108 3057 0810 4508 0057 0680 4903 6072 0360 5607 4078 0880 6205
5078 0650 5903 9041 0340 1009 0053 0710 7608 6054 0370 4108 8057 0390 6009
3047 0500 4008 9040 0840 4006 9057 0370 3305 1050 0710 8107 6049 0820 6107
8051 0840 7803 6054 0800 3704 8044 0530 7805 6053 0360 5707 4044 0390 9607
5057 0380 8203 8061 0360 6103 6010 0900 5703 9086 0880 4907 3078 0420 5303
6090 0900 5105 5041 0370 4403 6040 0750 4603 5061 0880 5008 4086 0430 5903
6078 0410 4807 2036 0670 5203 8076 0900 4808 1090 0770 4405 1057 0700 4908
3049 0510 4903 5049 0690 5503 4093 0870 1009 0051 0740 3307 2049 0370 8107
5052 0510 8206 9057 0520 9004 2056 0840 4506 7055 0340 9308 1049 0810 9006
5061 0800 4903 6057 0390 3703 6054 0820 3707 7052 0740 6106 0043 0730 8604
5053 0810 7604 6062 0820 8204 9048 0820 8603 8010 0900 5007 3041 0810 4908
0082 0900 6105 5041 0330 5605 5053 0500 5705 4057 0820 6103 6072 0870 5408
3076 0390 6203 6076 0710 6007 3082 0890 5807 3049 0350 5107 1056 0760 4605
3057 0490 4605 5053 0400 5008 2041 0690 5503 4093 0560 1009 0053 0730 3705
8056 0730 7606 9051 0540 4504 0051 0540 5708 6048 0710 3707 4056 0710 5307
7053 0360 4903 5054 0360 8206 6053 0810 6803 3046 0360 5703 6051 0520 4908
0051 0800 8205 4056 0700 3704 7062 0800 3703 7049 0720 8606 8010 0420 5708
2086 0380 4605 5037 0740 4705 1071 0790 5504 8096 0960 1009 6010
-
Re: CCProtect (encrypt and decrypt cc's)
-
Re: CCProtect (encrypt and decrypt cc's)
Heheheeheeeeeee... yeah when NSA try to decode it with a RSA tool they will have a surprise :)
Nice video!
-
Re: CCProtect (encrypt and decrypt cc's)
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
iceblade112
Cool... but only cc's?
No, all kind of messages can be encrypted. But this was made for encrypting my clients credit card. Therefore it's called CCProtect.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Zensai
Heheheeheeeeeee... yeah when NSA try to decode it with a RSA tool they will have a surprise :)
Nice video!
Why would NSA want to decode credit card numbers when they have access to bank databases? Not to mention they have the php code you use to decrypt the numbers, due to ISP backdoors.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Mootie
Why would NSA want to decode credit card numbers when they have access to bank databases? Not to mention they have the php code you use to decrypt the numbers, due to ISP backdoors.
This can be used to encrypt all kind of messages, not only credit cards. NSA cannot trace where the code comes from with just this large digit so they can't really get hang of the PHP code. But now since it released they have it.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Zensai
This can be used to encrypt all kind of messages, not only credit cards. NSA cannot trace where the code comes from with just this large digit so they can't really get hang of the PHP code. But now since it released they have it.
When you uploaded it to a webserver, they got it. Unless maybe if you were using SSL /w non-registered cert.
I believe protecting your data from government access is ridiculous anyways. However, have you considered that someone with access to your database would likely also have access to your php website's code?
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Mootie
When you uploaded it to a webserver, they got it. Unless maybe if you were using SSL /w non-registered cert.
I believe protecting your data from government access is ridiculous anyways. However, have you considered that someone with access to your database would likely also have access to your php website's code?
But the point is that they don't know where the code comes from. If the db where you store the cc's or .txt files get leaked for example they cannot trace it back to my web server where it's located.
I am not hiding anything because I got nothing to hide but this can be used to do it.
-
Re: CCProtect (encrypt and decrypt cc's)
If you seriously think the NSA would have a hard time decrypting this, you're sorely mistaken.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
JaydenC
If you seriously think the NSA would have a hard time decrypting this, you're sorely mistaken.
I do actually think they are going to have a hard time. If they manage to find out how to decode the integers they will come to an json array with 8 blind ways. It is four blind ways with the same length as the message using the generateRandomString, 4 blind ways that tell what field the message is stored in. To decrypt that they'll need the password stored in the final product somewhere. Then they'll need to decrypt that field containing the real key to decrypt the real message field.
=
Mindfuck
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Zensai
I do actually think they are going to have a hard time. If they manage to find out how to decode the integers they will come to an json array with 8 blind ways. It is four blind ways with the same length as the message using the generateRandomString, 4 blind ways that tell what field the message is stored in. To decrypt that they'll need the password stored in the final product somewhere. Then they'll need to decrypt that field containing the real key to decrypt the real message field.
=
Mindfuck
Yeah, what I meant was that you posted your encryption algorithm on a public forum that anyone can see. Also, your encryption randomizes every time which almost makes it useless. I'll tell you why.
For example, using md5 for passwords is good because when a user logs in, it checks their password by using md5(password) and the encrypted password will always be the same. So lets say you are entering somebodys credit card number to check their information or something, when you use your function it will output a completely different number than the original encrypted number. Get it?
This encryption method is only good for throwing away credit card numbers, a better way of doing that is just throwing them away.. Hope you get what I am saying.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
JaydenC
Yeah, what I meant was that you posted your encryption algorithm on a public forum that anyone can see. Also, your encryption randomizes every time which almost makes it useless. I'll tell you why.
For example, using md5 for passwords is good because when a user logs in, it checks their password by using md5(password) and the encrypted password will always be the same. So lets say you are entering somebodys credit card number to check their information or something, when you use your function it will output a completely different number than the original encrypted number. Get it?
This encryption method is only good for throwing away credit card numbers, a better way of doing that is just throwing them away.. Hope you get what I am saying.
I agree that publishing this on a public forum isn't a smart move but I am not using this anymore.
AES 256 is military-grade and virtually uncrackable.
And it's wrong saying that this is like throwing away cc's lol.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Zensai
I agree that publishing this on a public forum isn't a smart move but I am not using this anymore.
AES 256 is military-grade and virtually uncrackable.
And it's wrong saying that this is like throwing away cc's lol.
No i'm not wrong when I say this throws away cc's because it randomizes the encryption every time rendering it virtually useless.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
JaydenC
Yeah, what I meant was that you posted your encryption algorithm on a public forum that anyone can see. Also, your encryption randomizes every time which almost makes it useless. I'll tell you why.
For example, using md5 for passwords is good because when a user logs in, it checks their password by using md5(password) and the encrypted password will always be the same. So lets say you are entering somebodys credit card number to check their information or something, when you use your function it will output a completely different number than the original encrypted number. Get it?
This encryption method is only good for throwing away credit card numbers, a better way of doing that is just throwing them away.. Hope you get what I am saying.
This is a two way encryption. Do not compare it to md5.
Quote:
Originally Posted by
JaydenC
No i'm not wrong when I say this throws away cc's because it randomizes the encryption every time rendering it virtually useless.
Yes you are wrong when you say that. This was built to look like RSA, hackers will think it's RSA and will get a surprise when they try to crack it.
This is how it looks when you decode it, does it make sense to you at all?
Code:
Array
(
[0] => 3096
[1] => 2139
[2] => 1788
[3] => 4982
[4] => 5925
[5] => 9561
[6] => 3518
[7] => 5152
[8] => 4799
[9] => 8878
[10] => 3
[11] => 9
[12] => 3
[13] => 9
[14] => 7
[15] => DlvJhSRikvecCLSl01r2Qpqg3gKd+HkLh77YNlwB28I=
[16] => OULNev/hvUwI7GD+//DD1jUjd1XljtFMXEF7VGUx59s=
[17] => h5nPwa5/xDo4PPP5yh7e4JstPqcGSUo2+4ATbd1Ntx8=
[18] => T1ql+GVSMN53Q5I24mrocY/fkGM9gQgDcYJHfksfYs0=
[19] => +bAknXg3A3+IgmrHvrtTmyM0WKnvMUEyGhqBo0a7muY=
[20] => 6qH4TvCruLTZFzyaqGHOZjxfkoHjAoDH/lZxxVM9A4c1bg4sHwA2aQuKCc8Nab+w8WT/pJgkgOJyRKLTtMIpGP8A+9h70jpJ1Kn+piatu9hdH5zkFqGTAdxJgdpF86PrDPOIPekGOsVXqPG7pjE2y0oEU33NYYFenBQTI1zAgetiRcgJEM9gXWwHfMtbbrRbcJ3tST1SBwFrMhCexhH8Yw==
[21] => cdov51fQh6Nwc+VK/t+vZ+0HGU0FqeWLa2ipspGpZd94uG0gL2a6aXkrfkXFeYUTEEBIgbjvlxbL1q+B+XmRH+TKXwzCRdpsnL9aEDDGLHrgj8cO5CRBNP554tRHrlj9C+euuMeAqY6JEaQGP4egux5LTjClELM9Ak/bdkfSi7DBFMWGqguDy1aDj1VXBHSWHuhgIE71+rkOik8voK2p7g==
[22] => OGy5IRzq1qNVaI/K2YylcQLmoEq7aLNAe3gGfD63TT1zOTgHXzzE1JHUj7bcB1YIL4kTCUFnERaUJJx42iX5eabHKv5KSdRbQHm4DueGBgjX/qdcfFetD8uB0a9mMkEqJDkkirXdQclkC3yB+tOGG2bGGc50rfY+wbSI1Y+2QjKo7KAQQ/Pg4E/QAqPYispsGo3glQJxUcrAoEaMKDOw5w==
[23] => TO6b65RWoKsnSb3q3o8vXi39rWwEheiTCyNRD/n4i1ie39mRBeYTqDMgYDS19Ht6pz3YtFvdP/OSp6QsOIHRHM9/KRm2RsFL41Ncr2GStIMKwgcF5TL8sUtUw901nRqASlhYDF4dom3M3p83WP8wzyq4gXEIIhEKhFAPTgbJSnVs1HsryhNv6oV6HF3RSpF9SK9pFY4we3+zCuzhx1ebjA==
[24] => XClf5goeo4Qdrnaf+Bf3bXz4pZ2zDF6fTGZEQE23j5KpyH3xYoh7rMneq5c32D0rCkpoePXBJTjKG2ED7jVD7fk4y+fPnJPVDO7HUgosN312uU1R2Dqiz4vVbFkD9GwTxHR5piuKLylkiblGw6cDwr2YP/heB7Fz5YohlGuZT9eCbw0UR5bLvRPVy92xuAu70YIUrmiPTx00LuEnVTmZKA==
[25] => BGqKWqAXlsN6ZxrN0qVtXlalFHGiFtKh8uccfmmlmS0Aih0Rx4ZvICJV65IGdvr02TsGVE9wPEtJm4H2I5R12gaQpnWxbWjer1o4qNplAjJ3yTuEauar7Os83N5VZGwqKmvbKKh3eQXDMbS/2kVBnr/vnYw8XCoSoTDv4dQpIWQdWmED88zbuydrzoFq8ng9473IuikDTo9nhmhebZMczg==
)
-
Re: CCProtect (encrypt and decrypt cc's)
Iv not looked into the code to much, But keep in mind there is no way to be 100% secure. As long as there is a way for you to get the original data, So can others.
That video i sent you, Its really hard to get the prime numbers that created the results. The more bits, the bigger the number and more harder to break the number up. Not even the NSA can decode the encryption but sure there is other ways around getting information. Helps when company's also openly give them the data in plain text so they don't need to decrypt to much.
Quantum computers are around the corner that would try every single possibility at the same time, There is some way to keep data safe with Quantum computers that the laws of physics guarantees you safety. (apparently anyway)
-
Re: CCProtect (encrypt and decrypt cc's)
Hey don't even post here if you can't handle some constructive criticism, i'm completely right no matter how you look at it. Maybe you don't understand and thats cool but no need to de-rep me for trying to explain your crappy way of encrpytion to you.
Look, if I put in my cc # 2 times i'm going to get 2 different results. Why? Because you randomize your string everytime making this useless.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
JaydenC
Hey don't even post here if you can't handle some constructive criticism, i'm completely right no matter how you look at it. Maybe you don't understand and thats cool but no need to de-rep me for trying to explain your crappy way of encrpytion to you.
Look, if I put in my cc # 2 times i'm going to get 2 different results. Why? Because you randomize your string everytime making this useless.
What are you takling about? Randomize what string? I'm really getting tired of your bullshit criticism because you clearly know nothing about what you're saying.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Zensai
What are you takling about? Randomize what string? I'm really getting tired of your bullshit criticism because you clearly know nothing about what you're saying.
Did you even code this? String = encrypted credit card number. It will be different every time you enter it. If you used any of PHP's encryption methods with a credit card number it will always be the same.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
JaydenC
Did you even code this? String = encrypted credit card number. It will be different every time you enter it. If you used any of PHP's encryption methods with a credit card number it will always be the same.
Sorry to interrupt, but what are you talking about?
Your logic sucks, sure you have parts right.
When you take the MD5 function with the CC number it will always be the same hash and you can't retreive the data from it. Adding a random string to the CC number without storing it somewhere else makes it impossible to check if it's the same.
Using the crypt function it generates everytime another hash and you can't retreive the data from it. And the nice part is, you can still check if it's the same, ofcourse only the user knows the original value.
Example can be found:*** removed ***play arround with that.
Unlike everything I've typed above, is this not a HASH class. Hash is mostly used to store user passwords because you can't decrypt it. With this class you CAN decrypt a value encrypted by this class.
But let me quess, you thought you checked the encoded string with each other and yes, that's not possible. You have to decrypt the encoded strings before you compare it. Makes sence right?
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Joopie
Sorry to interrupt, but what are you talking about?
Your logic sucks, sure you have parts right.
When you take the MD5 function with the CC number it will always be the same hash and you can't retreive the data from it. Adding a random string to the CC number without storing it somewhere else makes it impossible to check if it's the same.
Using the
crypt function it generates everytime another hash and you can't retreive the data from it. And the nice part is, you can still check if it's the same, ofcourse only the user knows the original value.
Example can be found:
PHP CRYPT play arround with that.
Unlike everything I've typed above, is this not a
HASH class. Hash is mostly used to store user passwords because you can't decrypt it. With this class you
CAN decrypt a value encrypted by this class.
But let me quess, you thought you checked the encoded string with each other and yes, that's not possible. You have to decrypt the encoded strings before you compare it. Makes sence right?
You're right but this function will still randomize everytime, no matter how you look at it. That's all I was trying to say.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
JaydenC
You're right but this function will still randomize everytime, no matter how you look at it. That's all I was trying to say.
It randomize everytime because the password changes everytime /facepalm
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Zensai
It randomize everytime because the password changes everytime /facepalm
I understand that. . . but if you put in the same credit card number twice you will get 2 different outcomes. Thats all i'm saying.
-
Then what is the problem?
Verstuurd van mijn HTC Butterfly
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
JaydenC
I understand that. . . but if you put in the same credit card number twice you will get 2 different outcomes. Thats all i'm saying.
As Joopie said, what is the problem?
You make no sense at all.
-
Re: CCProtect (encrypt and decrypt cc's)
The point JaydenC means is following:
Let's say person one stores his/her cc in your db via encryption above. He/She pays a product on your page with his/her cc for example.
Now the only reason why to keep this data that cannot be de-crypted to it's original data (due random string) is to compare it with other credit cards only. But even that will not work, because user2 puts the same cc in your db but the output is completely different. Instead of a random string you should store a fixed string anywhere, otherwise it's not possible to use the stored cc data for any use.
That's his point.
Also the fact this:
PHP Code:
$protection = new CCProtect;
$cc = array(
'firstname' => 'Krista',
'lastname' => 'Sheppard',
'dob' => 'August 11, 1932',
'cardnumber' => '4916 5210 7061 9044',
'cvv2' => '769',
'expire' => array(
'month' => '6',
'year' => '2015',
),
);
$cc2 = $protection->decrypt($protection->encrypt($cc), 75));
... does not work ($cc is not the same like $cc2) makes it an encryption without decryption only.
Then it's easier to put everything as salted string into md5.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
שเ๒єtгเ๒є
The point JaydenC means is following:
Let's say person one stores his/her cc in your db via encryption above. He/She pays a product on your page with his/her cc for example.
Now the only reason why to keep this data that cannot be de-crypted to it's original data (due random string) is to compare it with other credit cards only. But even that will not work, because user2 puts the same cc in your db but the output is completely different. Instead of a random string you should store a fixed string anywhere, otherwise it's not possible to use the stored cc data for any use.
That's his point.
So ...
PHP Code:
$protection = new CCProtect;
$cc = array(
'firstname' => 'Krista',
'lastname' => 'Sheppard',
'dob' => 'August 11, 1932',
'cardnumber' => '4916 5210 7061 9044',
'cvv2' => '769',
'expire' => array(
'month' => '6',
'year' => '2015',
),
);
$cc2 = $protection->decrypt($protection->encrypt($cc), 75));
So $cc will not equal to $cc2, so it's unable to decrypt cc's. ...
No, this is a two way encryption. The encryption password is stored in the final big int string. The decryption function will get the password, decode the string and then figure out what field the encrypted cc is stored in. When that is found it will decrypt the message with the random password generated (that's stored in the final big int) and return that.
It doesn't matter how long the message you wan't encrypted is, what it is or what kind of type characters it is.
I don't know where you guys get this "random string" thing from either.
Since it's really hard for you guys to understand an example is coming up.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
שเ๒єtгเ๒є
*Some weard shit...*
If you're right, then my apache server lies to me...
*** removed ***
-
Re: CCProtect (encrypt and decrypt cc's)
Here's a live demo:
http://goo.gl/T4Tb5L
Script:
PHP Code:
<?php
class CCProtect {
private function pekkaEncode($s) {
$out = '';
for ($i=0;$i<strlen($s); $i++) {
$out .= sprintf("%03d", ord($s[$i]));
}
return $out;
}
private function pekkaDecode($s) {
$out = '';
for ($i=0;$i<strlen($s);$i+=3) {
$out .= chr($s[$i].$s[$i+1].$s[$i+2]);
}
return $out;
}
private function generateRandomString($length = 10) {
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$randomString = '';
for($i = 0; $i < $length; $i++) {
$randomString .= $characters[rand(0, strlen($characters) - 1)];
}
return $randomString;
}
private function mCrypt($text, $salt) {
return trim(base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($salt), $text, MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND))));
}
private function mDecrypt($text, $salt) {
return trim(mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($salt), base64_decode($text), MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND)));
}
public function encrypt($content) {
$response = array(
0 => rand(1000, 9999),
1 => rand(1000, 9999),
2 => rand(1000, 9999),
3 => rand(1000, 9999),
4 => rand(1000, 9999),
5 => rand(1000, 9999),
6 => rand(1000, 9999),
7 => rand(1000, 9999),
8 => rand(1000, 9999),
9 => rand(1000, 9999),
10 => rand(0, 9),
11 => rand(0, 9),
12 => rand(0, 9),
13 => rand(0, 9),
14 => rand(5, 9),
15 => '',
16 => '',
17 => '',
18 => '',
19 => '',
20 => '',
21 => '',
22 => '',
23 => '',
24 => '',
25 => '',
);
$rand = rand(10, 14);
$combination = str_split($response[$response[$rand]], 1);
$password = $response[$combination[0]] . $response[$combination[1]] . $response[$combination[2]] . $response[$combination[3]];
if(is_array($content)) {
$content = json_encode($content);
}
$content_length = strlen($content);
$content_field = rand(20, 25);
$store_content_field = 10 + $response[14];
for($i=15; $i <= 19; $i++) {
if($i == $store_content_field) {
$response[$i] = $this->mCrypt($content_field, $password);
} else {
$response[$i] = $this->mCrypt(rand(10, 99), $password);
}
}
for($i=20; $i <= 25; $i++) {
if($i == $content_field) {
$response[$i] = $this->mCrypt($content, $password);
} else {
$response[$i] = $this->mCrypt($this->generateRandomString($content_length), $password);
}
}
$json = json_encode($response);
$string = $password . $this->pekkaEncode(str_rot13(convert_uuencode($json)));
$string = str_split($string, 4);
$string = implode(' ', $string);
return trim($string);
}
public function decrypt($string) {
$string = str_replace(' ', '', $string);
$password = substr($string, 0, 16);
$decoded = json_decode(convert_uudecode(str_rot13($this->pekkaDecode(substr($string, 16)))));
return trim($this->mDecrypt($decoded[$this->mDecrypt($decoded[10 + $decoded[14]], $password)], $password));
}
}
$protection = new CCProtect;
$cc = array(
'firstname' => 'Krista',
'lastname' => 'Sheppard',
'dob' => 'August 11, 1932',
'cardnumber' => '4916 5210 7061 9044',
'cvv2' => '769',
'expire' => array(
'month' => '6',
'year' => '2015',
),
);
?>
<html>
<head>
</head>
<body>
<h1>CCProtect example</h1>
<?php
$action = (isset($_GET['action']))?$_GET['action']:'encrypt';
switch($action) {
case 'decrypt':
echo '
<form action="?action=showdecrypt" method="POST">
Enter your encrypted message:<br />
<textarea style="height: 680px; width: 660px" name="message"></textarea><br>
<input type="submit" value="Decrypt!">
</form>
';
break;
case 'showdecrypt':
if(!isset($_POST['message'])) {
header("Location: ?action=error");
exit;
}
$message = $_POST['message'];
echo '
Here is the decrypted result of your message:<br />
<textarea style="height: 680px; width: 660px">' . $protection->decrypt($message) . '</textarea><br>
<a href="?action=encrypt">Encrypt another message</a>
';
break;
case 'showencrypt':
if(!isset($_POST['message'])) {
header("Location: ?action=error");
exit;
}
$message = $_POST['message'];
echo '
Here is your message encrypted!<br />
<textarea style="height: 680px; width: 660px">' . $protection->encrypt($message) . '</textarea><br>
<a href="?action=decrypt">Decrypt this message</a> (copy & paste) - <a href="?action=encrypt">Encrypt another message</a>
';
break;
case 'encrypt':
echo '
<form action="?action=showencrypt" method="POST">
Encrypt a message:<br />
<textarea style="height: 680px; width: 660px" name="message"></textarea><br>
<input type="submit" value="Encrypt!">
</form>
';
break;
case 'error':
echo 'Something went wrong when trying to complete your action. Please try agian.<br><a href="?action=encrypt">Go back</b>';
break;
default:
echo '';
}
?>
</body>
</html>
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Joopie
*Some weard shit...*
Do not quote me instead!
---
Quote:
Originally Posted by
Zensai
No, this is a two way encryption. The encryption password is stored in the final big int string. The decryption function will get the password, decode the string and then figure out what field the encrypted cc is stored in. When that is found it will decrypt the message with the random password generated (that's stored in the final big int) and return that.
I explained JaydenC's point of view. Thanks for pointing this out, because I did not follow the code line by line to test the algorithm as well as I do not own an apache to test it here.
Quote:
Originally Posted by
Zensai
I don't know where you guys get this "random string" thing from either.
Maybe because of the private function called generateRandomString that is only called within the function encrypt?
Anyway, cheers.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
שเ๒єtгเ๒є
Do not quote me instead!
---
I explained JaydenC's point of view. Thanks for pointing this out, because I did not follow the code line by line to test the algorithm as well as I do not own an apache to test it here.
Maybe because of the private function called generateRandomString that is only called within the function encrypt?
Anyway, cheers.
Lol, you should have tested the script before you started to defend him.
generateRandomString is called to make blind ways for potential hackers.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Zensai
Lol, you should have tested the script before you started to defend him.
generateRandomString is called to make blind ways for potential hackers.
Nah, it's more a misunderstanding I wanted to help to resolve in my eyes. Thanks.
-
Re: CCProtect (encrypt and decrypt cc's)
Why do people bother securing data in this fashion? You obviously don't understand basic cryptography if you're using ECB to encrypt such a large amount of data.
First 2-3 variables(first & last name, dob) are relatively easy to guess and might be stored elsewhere in database. If you know them, you can decrypt the rest relatively easily.
You might think the whole randomization is clever obfuscation, but sophisticated string pattern analysis will break this in milliseconds. Essentially, anyone that's using code to encrypt user creditcard numbers with methods not verified by a professional cryptographer AND network security analyst, is only fooling themselves into believing their methods are any better than storing in plaintext against a decent attack.
Securing decryptable data is much more complex than storing hashes, but even experts can fail at securing hashes. One example is a hash authentication blunder shown here... Full Disclosure: MD5 hash extension attack breaks API authentication of Flickr and other online services.
But this is especially moot(no pun intended) when talking about pservers. Almost every pserver admin I've encountered will hand over root to any dev that seems to know what they're talking about. Why bother with such silly encryption when your server can be hacked much easier with extremely minimal social engineering?
-
Re: CCProtect (encrypt and decrypt cc's)
You'd think when it comes to what is effectively a glorified substitution cipher, the randomness of the ciphertext would be the least of people's worries. Is there a lot of entropy? Yes. Enough to make brute force cryptanalysis pointless? Yes, but that's a feature of every modern cryptographic cipher, which this one mostly inherits through the use of AES. Is it going to stump a hacker who's rooted your server? Not really, it's more like a Christmas present. This cipher is only slightly more secure than plain ol' ROT13.
-
Re: CCProtect (encrypt and decrypt cc's)
Quote:
Originally Posted by
Mootie
You might think the whole randomization is clever obfuscation, but sophisticated string pattern analysis will break this in milliseconds. Essentially, anyone that's using code to encrypt user creditcard numbers with methods not verified by a professional cryptographer AND network security analyst, is only fooling themselves into believing their methods are any better than storing in plaintext against a decent attack.
This bolded remark is extremely important. When time permits, I often prefer coding my own application architecture from the ground up. I won't get into the benefits and detriments of this practice, but I must say that one thing I never do myself is anything regarding cryptography. It's a very complex field that has its own set of professionals.
When it comes to this level of security, don't take matters into your own hands unless you know exactly what you're doing. And chances are that you don't. Leave it to the experts in cryptography and security to handle this. There are already many released documents, code examples, and so on from heavily experienced groups and people that will secure whatever you need to secure much more effectively than anything you could come up with on your own. Don't code like you're an expert in cryptography unless you are. Don't take security into your own hands. Use proven methods.
