Can we decrypt orders outside of Merchant?

[Kent Multer]

Hi, been getting some interesting inquiries about custom projects lately ...

One client has a service that reads order data out of the Miva DB for after-order processing. They would like to be able to decrypt the encrypted payment data in their own app. Is that possible?

I know that a lot of the decryption code is in the LSK; but I seem to recall reading that some critical parts of this are being withheld from the public for security. Or maybe it's only the encryption, not the decryption, that contains the confidential code. Can someone refresh my memory? Is it possible to decrypt payment data without actually calling the Miva library functions, by writing the same algorithms into another program?

Thanks --

[wmgilligan]

HI Kent,
I think you could do it - if you knew how it was encrypted. Which is likely out there... but - I think the underlying issue may be the PCI compliance. Once you get access to the info - and decrypt it - I think that would make the compliance null.

Maybe you could rethink what it is they need to do with the info, and try to attack it that way. In our case, we have a backend system that can access our processor and do refunds, additional charges, etc. using a transaction token. So even though we can not get to the info, we can still do whats needed via an api.

B

[ILoveHostasaurus]

This is not possible because the algorithms rely on internal store-specific data, in addition to the encryption pass phrase, to accomplish the decryption.

Having any third party app or service talking directly to the database the store uses is an absolutely horrible situation from a security standpoint, regardless of whether it has access to payment data, so making it even worse by allowing it to decrypt order data should never be done. Such a setup already (due to it having access to the database the payment application uses) brings that app, the computer it resides on, the network that computer resides on and the staff with access to that system all into scope for PCI, may violate a merchant account agreement, and also may subject the store owner to increased liability. In such a situation, there is zero logging of the activity, so here you have a database server that has been intentionally set up to expose it to the internet (even if firewalled to just a specific IP), and a remote server, app, who knows what, that has access to read and update data, and could be doing anything with it with no record of when, what or who performed what action since the database server is not logging every query.

The only way order data should be decrypted for a remote service or application is by using the Miva Merchant API to do it, whether that means a custom module, enterprise tools, etc. In that situation, authentication would be required, and decryption activity would be logged just like if it was an interactive user doing it. It would also prevent someone who had compromised the remote system from making changes to the store database, etc. For example, if someone compromised the currently directly connected system, they could simply enable a payment module, or alter the existing one, by direct database update, so credit card transactions submit to their own gateway URL and they start collecting all the customers' cards.

[benjamintr]

This is exactly what I need to do now that all credit card data is encrypted. Just so I'm understanding correctly... So the solution is to write something that will connect to the Miva API and download all the order information along with the credit card data that has already been decrypted on the Miva end?

[Kent Multer]

Hi Ben,

I think David is recommending that, if you need to decrypt the payment data, you do it by having a module running in the store that decrypts the data and passes the results to your app in the reply, using secure HTTP of course. David, please correct me if I've misunderstood.

That's how I do it in my own projects. I've never written code that connected directly to the store's DB. I don't know whether there are other 3rd-party services that do that. Most companies that offer such services do seem to provide a connector module that must be installed in the store.

Ben, if you need someone to provide a module for this purpose, you can contact me by email to discuss it in more detail.

Thanks --

[benjamintr]

Thanks Kent! I'm a newbie when it comes to the API. So I guess the Miva API is only accessible by an internal module and can't be called remotely via some other protocol?

[Kent Multer]

Hmmm, the term "API" is somewhat loosely defined ... As I understand it, decryption can only be done by calling the decryption functions that are contained within Miva Merchant. That means you need either a module, or maybe a stand-alone script that can read enough DB variables to simulate the Miva Merchant environment. The module would probably be easier to write than the stand-alone script.

Hope that helps --

[Bruce - PhosphorMedia]

Lets be clear. There is "can do" and there is "should do". However, when it comes to Miva Merchant's encryption, both (should/could) require the use of a module. Secondly, even with the "could" of a module based solution, there is a SHOULD NOT". You SHOULD NOT, UNDER ANY CIRCUMSTANCES, have decrypted data exist outside the merchant environment. PERIOD.