Search code examples
encryptioncryptographypci-compliance

XOR encryption/decryption and compliance

XOR encryption/decryption is very basic mechanism where one does not need any keys to encrypt.

I have used this for file encrypt/decrypt in C++. The file contains secure data. The file is divided into many fixed sized chunks and different characters are used to encrypt different chunks getting me a encrypted file.

I would like to know two things:

  1. if there is another way to encrypt it more securely?
  2. is such mechanism acceptable if PCI compliance is considered?

I cannot add support of any crypto library like openssl etc. to my current environment.

Thanks for your help.

Solution

  • You've somewhat answered your own question. XOR "encryption", if you can call it that, should never be used in production code. At an academic level, it provides an excellent example of a broken encryption scheme that inexperienced cryptographers can perform cryptanalysis on. Past that, it is useless. Contrary to what you state, however, XOR encryption does require a key.

    The industry standard symmetric encryption algorithm at the time of writing is AES. AES is used in many widespread protocols like TLS and SSH.

    XOR encryption is also definitely not acceptable for things like PCI compliance.