Authorize.net Changing MD5 to SHA-512

Magento’s current implementation of the Authorize.Net Direct Post payment method uses MD5 based hash.

However, Authorize.net will stop supporting MD5 based hash usage on March 14, 2019.

If you don’t upgrade, your payment processing through Authorize.net will not work after March 14, 2019.

Customer Paradigm’s team can help!

We can:

• Apply the Magento patch.
• Generate a new key in Authorize.net
• Replace the MD5 hash with a new signature key (SHA-512) in the Magento admin

We’ve already completed this for many of our clients, and can do this quickly and efficiently for you.

Please contact us for more information to get started.

We will need:

• SSH access to your site to apply the patch
• Authorize.net access to re-generate the signature key
• Magento admin access to save the new key

Why the change? According to Wikipedia’s MD5 article:
“The MD5 message-digest algorithm is a widely used hash function producing a 128-bit hash value. Although MD5 was initially designed to be used as a cryptographic hash function, it has been found to suffer from extensive vulnerabilities. It can still be used as a checksum to verify data integrity, but only against unintentional corruption. It remains suitable for other non-cryptographic purposes, for example for determining the partition for a particular key in a partitioned database.

One basic requirement of any cryptographic hash function is that it should be computationally infeasible to find two distinct messages which hash to the same value. MD5 fails this requirement catastrophically; such collisions can be found in seconds on an ordinary home computer.

The weaknesses of MD5 have been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially “cryptographically broken and unsuitable for further use”.

Jeff Finkelstein, Founder Customer Paradigm

A note from Customer Paradigm’s founder, Jeff Finkelstein:

My passion is helping Magento commerce businesses like yours leverage the power of the Web to aggregate customers according to interest, and not geography. 12,600+ projects later, I still love what we’re doing, and I love that the premise of the company – customer-centric thinking – is still just as valid and relevant today as it was back in 2002.

Back then (before Facebook, Twitter, YouTube, the iPhone, Amazon Prime, Gmail or Shopify), I saw that the companies that were succeeding online were the ones that were focused on the end customer experience.

The name of the company, Customer Paradigm, was based on the assumption that end customers increasingly have control over their purchasing experience. Buying online, interacting with people based on interest instead of geography – all of this was made possible by the Web.

In 2002, we helped businesses with three things: Acquiring new customers, retaining existing ones, and interacting with them online.

In 2019, the underlying goals are the same, but strategies and tactics are in many cases radically different.

My favorite part of the day is talking to business owners like you to discuss your digital marketing goals, and see if there’s anything I can recommend that may make your Magento site or your brand more successful.

Let me know – I can meet here in Boulder, or over the phone – 303.473.4400.

Thanks! – Jeff
Customer Paradigm founder Jeff Finkelstein has been called a “Web Guru” by the New York Times.