[#7418] Authorize.Net is phasing out the MD5 hash

Got an email from authorize.net that says they are fazing out MD5 Hash. What do we need to do?

Authorize.Net is phasing out the MD5 hash, an older method used by shopping carts, payment modules and plugins to verify that transaction responses are genuine and from Authorize.Net. We have identified that you have this feature configured and may be relying on this older method.

Please contact your web developer or solutions provider and confirm if you are using an MD5-based hash. If so, you should begin plans for moving to SHA-512 hash via Signature Key.

The MD5 Hash will phase out in two phases:

Phase 1 - Starting later this month to early February 2019, we will remove ability to configure or update MD5 Hash setting in the Merchant Interface. There are no changes to the existing API response.
Phase 2 - Stop sending the MD5 Hash data element in the API response. This change will require that applications support the SHA-512 hash via signature key. Dates for phase 2 will be announced later but is expected in the next 2-3 months.

Please refer to our support article: MD5 Hash End of Life & Signature Key Replacement for more details and information on this change.

Thank you for your attention to this matter and for being an Authorize.Net merchant.

Sincerely,
Authorize.Net

We've the following feature ticket to review upgrading the hashing in the Authorize.net gateway.

forge.joomlapolis.com/issues/7418

Hello Kyle,
Looks like MD5 for authorize.net will be phased out by 3/28/19:

Phase 2 - Stop sending the MD5 Hash data element in the API response. To continue verifying via hash, this will require applications to support the SHA-512 hash via signature key.

Sandbox will be updated on March 7, 2019 to stop populating the MD5 Hash value, but the field will still be present but empty.
Production will be updated on March 28, 2019 to stop populating the MD5 Hash value, but the field will still be present but empty.

Thanks for informing us about the new very short notice date of production by authorize.net.

I have now setup a new authorize.net sandbox account in order to be able test the change, and we will be releasing a new version of CBSubs.

We need to go live soon, and authorize.net is the only payment gateway we are supposed to use. Any estimate date for the authorize.net to work with CB Subs?

Authorize.net works today with CBSubs, and we hope to have a new tested version for their SHA hash in time for their very short-noticed phase-out of their MD5 hash.

We have initiated a SHA test-transaction with ARB on their test gateway end of last week. But their test gateway (still! 10 years after we told them it's a big annoyance) implements the 7 days minimum renewal interval, so we won't get the ARB silent post with the SHA hash before end of this week! So only thing I can say is that it won't be before mid-next week that we will have a CBSubs release that supports SHA in a tested way.

According to their very short noticed dates here support.authorize.net/s/article/MD5-Hash-End-of-Life-Signature-Key-Replacement :

Phase 1 - As of February 11, 2019 we have removed ability to configure or update MD5 Hash setting in the Merchant Interface. Merchants who had this setting configured have already been emailed/contacted.

Phase 2 - Stop sending the MD5 Hash data element in the API response. To continue verifying via hash, this will require applications to support the SHA-512 hash via signature key.

• Sandbox has been updated as of March 7, 2019 to stop populating the MD5 Hash value, but the field will still be present but empty.
• Production will be updated on [strike]March 14, 2019[/strike] March 28, 2019 (updated) to stop populating the MD5 Hash value, but the field will still be present but empty.

If you have a sample SHA2 ARB silent post from your history logs/notifications logs, with the corresponding SH2 key for us to try to implement the undocumented ARB SHA2 hash, please PM it to me.

Worst case, we will provide a way to remove the MD5 hash check, which is what most carts have done!!! Which is quite sad.

Needless to say that we do not recommend Authorize.net for new projects, given their very short notice phase-out notices.

You should contact your Auth.net sales representative and protest for such short-notice business-breaking practices.