email security

[judi]

My ecommerce site is in PHP and it's working fine. I'm going to use a Quick SSL and I understand it all. But I still have one problem.

My client wants the credit card# and all the info emailed to them and they will do the transaction from their office. I can't figure out how to email the info and have it secured. I know that PHP has the mcrypt_encrypt function, so I can encrypt the email to be sent. But how does it get unencripted? My client doesn't have PHP on their system. I guess I can use an encrypting algorithm in the PHP code and then write a C or VB compiled program they can run on their computer to unencrypt it. But I can't believe there isn't a better way to do it since I'm sure I'm not the only one who is doing an ecommerce site like this.

Is there a better way to do this? Any suggestions would be appreciated.

 

[DRJ478]

I suggest you have a look at PGP encryption. It is basically free and a good way to secure the information;
Here's some code from the PHP site for encryption using PGP:

<?PHP
function pgp_encrypt($keyring_location, $public_key_id, $plain_text) {

       $key_id = EscapeShellArg($public_key_id);
       putenv("PGPPATH=$keyring_location");

       // encrypt the message
       $pipe = popen("pgpe -r $key_id -af", "r");             
       fwrite($pipe, $plain_text);
       $encrypted_text = '';
       while($s = fgets($pipe, 1024)) {
               // read from the pipe
               $encrypted_text .= $s;
       }
       pclose($pipe);

       return $encrypted_text;
}

$message = pgp_encrypt("/home/username/.pgp", "to@domain.com", "dummy text to be encrypted");
print nl2br($message);

?>

 

[judi]

Thanks for this. But how does it get un-encrypted on my client's side? That's where I'm having the trouble. She doesn't have PHP on her computer. Will I have to write a little compiled program?

 

[DRJ478]

All standard e-mail clients offer PGP support. You generate a key pair and the key is installed at the clients e-mail software. That's how they decrypt it. There is no PHP involved at all.
All you need to do is to install the PGP software on the clients machine.