title: How to securely encrypt credit card information in a database
body: <p>I have already read through <a href="https://stackoverflow.com/questions/3328922/saving-credit-card-information-in-mysql-database">Saving credit card information in MySQL database?</a> and <a href="https://stackoverflow.com/questions/633384/storing-credit-card-information">Storing Credit Card Information</a>.</p>
  
  <p>I'm aware that storing credit card information requires PCI compliance, which is not an easy task.</p>
  
  <p>That is not what this question is about. My question is the following:</p>
  
  <p>What is a secure way to encrypt user credit cards? The simplest and easiest that comes to mind is using a private key and encrypting CC's with that. This doesn't seem very secure because the key has to be stored on the server, and if an attacker can get my database, they can probably get the key too.</p>
  
  <p>What I'd like to be able to do is encrypt every CC using that users password as part of the encryption process. If anyone gets the database, they can't decrypt anything because the passwords are stored as salted hashes. This would work great for transactional purchases - the user clicks "Buy," types in their password as a confirmation, I decrypt their CC and make the charge. Their password is only in memory for the duration of the request, and is never written to disk.</p>
  
  <p>Unfortunately this won't work for what I'm trying to build - a service which charges a recurring fee (say, once a month), regardless of whether or not the user is logged in when I need to make the charge.</p>
  
  <p>Given this scenario, is there a secure way of storing user CC's? </p>