# Credit card **URL:** \ **Category:** Rails\ **Created:** [November 26, 2007, 5:11pm UTC](https://www.ruby-forum.com/t/credit-card/121297 "2007-11-26T17:11:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [November 26, 2007, 5:11pm UTC](https://www.ruby-forum.com/t/credit-card/121297/1 "2007-11-26T17:11:01Z")
Hi all, I got some code from this very site demonstrating how to do credit card encryption and I was wondering if someone here could help me understand the code. def crypt\_number c = cipher c.encrypt c.key = key c.iv = self.iv = generate\_iv(passphrase) end def cipher Open::Cipher::Cipher.new(“aes-256-cbc”) end def key Digest::SHA256.digest(@@CreditCardSecretKey) end def generate\_iv(Passphrase) encode\_into\_base64(DIgest::SHA1.hexdigest(passphrase)) end def encode\_into\_base64 Base64.encode64(string).chomp end I am trying to understand the basics about encryption. I’m not sure if this code is even something I can use, I just want to better understand so I can write my own program as needed. I guess the parts that I am confused about are c = cipher and what c.iv = self.iv = generate\_iv(passphrase) is doing. I understand that the c.encrypt is just encrypting the credit card number, just not about the rest. Is the c = cipher saying how the long the key will be? And I have no idea about what the c.iv stuff is doing. Thanks, -S ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [November 26, 2007, 5:22pm UTC](https://www.ruby-forum.com/t/credit-card/121297/2 "2007-11-26T17:22:19Z")
On 26 Nov 2007, at 16:11, Shandy N. wrote: > the > rest. Is the c = cipher saying how the long the key will be? And I > have > no idea about what the c.iv stuff is doing. Thanks, c = cipher is just caller the cipher method defined above, which just does Open::Cipher::Cipher.new(“aes-256-cbc”), i.e. give me a new cipher object that does 256bit AES in CBC mode. c.encrypt says that you want to encrypt and the iv is the initialization vector. You can read up on that if you want, essentially it’s just one of the parameters for the encryption Fred ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [November 26, 2007, 5:27pm UTC](https://www.ruby-forum.com/t/credit-card/121297/3 "2007-11-26T17:27:35Z")
The code uses sha256 to hash the secret key, then uses aes-256 (aes cipher with a 256-bit key) in cbc mode which means cipher block chaining. This does not mean you are using a 256-bit key. If you hash “1234” you have at BEST a 8 bit or so key. I would use a string that is randomly generated using strong random sources and make it a long string. The cipher used is symmetric so if the server encrypts the cc number it can also decrypt it. You probably do not want thatcas anyone who can get your database probably has your code too. Really, huge problems always occur when someone who knows little of cryptosystems and how to apply them runs off and writes something. This is now meant as an insult. I believe if you need this functionality the questions you are asking lead me to believe you are not yet ready to do it yourself. –Michael On Nov 26, 2007, at 8:11, Shandy N. \ **Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [November 27, 2007, 4:35pm UTC](https://www.ruby-forum.com/t/credit-card/121297/4 "2007-11-27T16:35:47Z") Sazima wrote: > I agree with Michael above. Start by reading “Applied Cryptography” by > Bruce Schneier ([http://www.schneier.com/](http://www.schneier.com/)). > > Best regards, Ricardo Thanks for the link. I know that I am may not be ready to do it myself but everyone has to start somewhere. Also, I have a boss who knows what he wants and how to do it and the fact that he is very knowledgable, especially when it comes to cryptography, leads me to beleive that I’ll be fine. I do appreciate all the advice though. -S ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [November 27, 2007, 4:22pm UTC](https://www.ruby-forum.com/t/credit-card/121297/5 "2007-11-27T16:22:22Z")
I agree with Michael above. Start by reading “Applied Cryptography” by Bruce Schneier ([http://www.schneier.com/](http://www.schneier.com/)). Best regards, Ricardo ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [November 27, 2007, 9:23pm UTC](https://www.ruby-forum.com/t/credit-card/121297/6 "2007-11-27T21:23:22Z")
There are certain laws and guidelines about storing credit cards. First, any credit card that is stored on your machine that is stolen without being a certified server runs the risk of not being covered by insurance and you could be held liable. Just don’t store credit card numbers. Store the transaction ID, it’s just as good to do pre-auths, purchases, and returns, but you won’t be able to do 1-click ordering with saved credit cards. If do you, then research it more on Google for PCI Compliance. Nathaniel. On 11/27/07, Shandy N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > he wants and how to do it and the fact that he is very knowledgable, > especially when it comes to cryptography, leads me to beleive that I’ll > be fine. I do appreciate all the advice though. > > ## -S > > Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/). > > > – Nathaniel Steven Henry Brown 604-724-6624