How Does the Profiles System Encrypt Data?
For the latest version of Commerce Server 2007 Help, see the Microsoft Web site.
By using Commerce Server 2007, you can store your data in either clear text or in an encrypted format. If you opt to have your data encrypted, Commerce Server stores the data in one of two formats:
One-way
Asymmetric
One-way encryption uses a hashing algorithm that does not require a public/private key pair, so it is easier to implement than asymmetric encryption. One-way encryption stores data in an encrypted format, but it cannot be decrypted. Instead, when Commerce Server needs to read data from the database, you must compare it with clear-text data that you must first hash in your code. An example of one-way encryption is storing passwords. You would use one-way encryption because being able to read password values would cause security vulnerabilities in Commerce Server 2007. For more information about hashing, see How to Hash Passwords.
Commerce Server 2007 supports the following three one-way hashing encryption algorithms, in order of preference:
SHA256. You use this algorithm to hash data in all editions of Commerce Server 2007, except the Developer edition. The Commerce Server Membership Provider uses SHA256 to verify one-way hashed passwords in all editions of Commerce Server 2007, except Developer edition.
SHA1. You use this algorithm to hash data only in Commerce Server 2007 Developer Edition because Microsoft Windows XP does not support SHA256. The Commerce Server Membership Provider uses SHA1 to verify one-way hashed passwords in Commerce Server 2007 Developer Edition.
MD5. Commerce Server 2007 supports this algorithm for backward-compatibility only with Commerce Server 2002.
Asymmetric encryption, sometimes known as two-way encryption, uses a public/private key pair to encrypt and decrypt data in the database. You use asymmetric encryption whenever you need to decrypt the encrypted data from the database. For example, you may have credit cards or social security numbers that are encrypted in the database, but need to be decrypted.
See Also
Other Resources
Profiles Encryption and Decryption