Link to home
Start Free TrialLog in
Avatar of Evan Cutler
Evan CutlerFlag for United States of America

asked on

Storing Social Security Numbers

Greetings,
I'm being asked to create a web-faced database storing PII and Privacy Act 1974 (same coverage?) information such as Social Security Numbers (SSN's).

I firmly believe (as with everyone else) that SSN's should not be stored in the clear.  They should be stored using Hash-246 or better.  I am more than open to wisdom on this method.

But my real question is output.  If my client wants to derive a report based on said individual, and needs the SSN to show up on the report, how do I get it back out of Hash and send it to the report?

thanks.
Avatar of Dave Baldwin
Dave Baldwin
Flag of United States of America image

If you want to get it back for a report, you need encryption, not a hash.  Hash is by definition a one-way process.

In addition, it may be illegal to transmit them in the clear so the question becomes how will you encrypt the reports that are developed over the internet?
Avatar of Evan Cutler

ASKER

I was considering VPN over SSL.

Do you have any input on how to perform encryption?
Thanks.
ASKER CERTIFIED SOLUTION
Avatar of Dave Baldwin
Dave Baldwin
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks...This helps alot.