Re-encrypting Credit Card, Bank Account Numbers, Security Code Data, and Security Key

PeopleSoft Campus Solutions encryption uses PeopleTools Pluggable Cryptography, which is an advanced security framework that provides a security model for applications to encrypt credit card data.

Pluggable Cryptography enables you to secure critical PeopleSoft data and communicate securely with other businesses. It enables you to extend and improve cryptographic support for your data in PeopleTools, giving you strong cryptography with the flexibility to change and grow, by incrementally acquiring stronger and more diverse algorithms for encrypting data. In PeopleTools, pluggable cryptography capability is provided by PeopleSoft pluggable encryption technology (PET).

By using the Tools Pluggable Cryptography for strong encryption/decryption, the system encrypts data using 3DES algorithms and 168-bit encryption keys.

To replace a known or suspected compromised key, regenerate the encryption key and convert existing credit card, bank account numbers, and Security Code data using the new key. Periodic key changes can be essential to your institution's encryption key management.

This section provides an overview of how to regenerate the encryption key and convert credit card, bank account numbers, and Security Code data using the new key.

When you change the encryption key at any time after the initial conversion, you must also re-encrypt all of your credit card, bank account numbers, and Security Code data using that key. Predefined encrypt and decrypt profiles are delivered for Campus Solutions re-encryption. These profiles specify multiple user-defined steps applying various algorithms and keys to the data in a specified order and supporting various encryption standards and third-party encryption libraries.

Use the following parameters for Campus Solutions re-encryption.

To change the credit card encryption key and re-encrypt the data, do the following:

1. Navigate to the Generate Encryption Key page select (Set Up SACR, then select Common Definitions, then select Encryption, then select Generate Encryption Key).

2. Click the Generate Random Key button to generate a new random hexadecimal encryption key.

   Clicking this button generates a new, random hexadecimal encryption key. You can modify this key. However, you must format it as a 24-byte string in hexadecimal notation. The first two characters must be 0x, and the remainder must be exactly 48 characters consisting of a combination of numeric digits and the lowercase letters a through f.

3. Copy the regenerated encryption key.

4. Navigate to the Algorithm page select (PeopleTools, then select Security, then select Encryption, then select Algorithm Keyset) for the encrypt algorithm ID and keyset ID (3des_ks168_cbc_encrypt and CSCredi Card).

5. Paste the regenerated encryption key value in the Key Value field, replacing the previous value, and save the page.

6. Navigate to the Convert Encryption page select (Set Up SACR, then select Common Definitions, then select Encryption, then select Convert Encryption).

7. Confirm that the encrypt and decrypt profile IDs are correct, then click the Run button to start the conversion process.

   The Credit Card Conversion process converts each field in the grid. If the process fails for any reason, the process can be restarted in the standard way and the process picks up where it left off. If the process cannot be restarted, the process can be run from the beginning and it automatically bypasses fields that have already been processed.

   Warning! You must complete steps 1-7 to encrypt and run the conversion process prior to completing the next steps, which set up decryption.

8. Navigate back to the Algorithm page select (PeopleTools, then select Security, then select Encryption, then select Algorithm Keyset) for the decrypt algorithm ID and keyset ID (3des_ks168_cbc_decrypt and CSCreditCard).

9. Paste the regenerated encryption key value in the Key Value field, replacing the previous value, and save the page.

See the product documentation for PeopleTools: Security Administration.

Access the Generate Encryption Key page (select Set Up SACR, then select Common Definitions, then select Encryption, then select Generate Encryption Key).

Image: Generate Encryption Key page

This example illustrates the fields and controls on the Generate Encryption Key page. You can find definitions for the fields and controls later on this page.

Access the Convert Encryption page (select Set Up SACR, then select Common Definitions, then select Encryption, then select Convert Encryption).

Image: Convert Encryption page

This example illustrates the fields and controls on the Convert Encryption page. You can find definitions for the fields and controls later on this page.