Implement tokenization

[adonese]

PCI compliant documents tokenization process as follows:

• tokenization shouldn't be derived from the card info

• we can not mathematically speaking, retrieve a pan from its tokenized data

• tokeniation does allow for using a cryptography secure function to generate a hash value that can be used as a token for card info

• pci strictly forbids storing cvv / cvv2 / or magnetic stripe track info

• pci doesn't forbid storing expiration date

• pci does forbid storing ipin/ pin/ and other authentication data

However both Stripe and OpenPay allows for storing: PAN, expDate, and CVC

CVV: card verification value AND CVC: card verfication code can be used interchangeable

With that in mind, our PCI compliant noebs vault will be like the following:

/api/tokenize

• PAN
• IPIN
• ExpDate

Response:

• ID
• Fingerprint (for fraud detection)

In server:

ID =>

Our super secure hash function =>

internal ID (UUID)

• PAN
• IPIN
• ExpDate

It is really tricky.