Answers.Body: <p>There is a <a href="https://github.com/civicrm/civicrm-core/pull/13474" rel="nofollow noreferrer">PR</a> from Monish to remove md5 hash support from Authorize.net payment processor in CiviCRM. Its now merged in master branch and should be part of 5.11 release.</p>
  
  <p>Cheers</p>
  
  <p>Pradeep</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-01-24T20:46:07.137Z
Answers.LastActivityDate: 2019-01-24T20:46:07.137Z
Answers.UserDisplayName: Pradeep Nayak
Body: <p>Regarding: 
  <a href="https://support.authorize.net/s/article/MD5-Hash-End-of-Life-Signature-Key-Replacement" rel="nofollow noreferrer">https://support.authorize.net/s/article/MD5-Hash-End-of-Life-Signature-Key-Replacement</a></p>
  
  <blockquote>
    <p>Authorize.Net is phasing out the MD5 based hash use for transaction response
    verification in favor of the SHA-512 based hash utilizing a Signature
    Key. The end of life for MD5 Hash will be done in two phases: Phase 1
    - Starting later this month to early February 2019, we will remove ability to configure or update MD5 Hash setting in the Merchant
    Interface. There are no changes to the existing API response.</p>
    
    <p>Phase 2 - Stop sending the MD5 Hash data element in the API response.
    This change will require that applications support the SHA-512 hash
    via signature key.  Dates for phase 2 will be announced later but is
    expected in the next 2-3 months.</p>
    
    <p>When you receive a transaction response from Authorize.Net, it
    includes the a SHA2 hash element the name and position depend on the
    API integration method used. The SHA2 has field contains HMAC-SHA512
    hash that Authorize.Net generated for the transaction.</p>
  </blockquote>
  
  <p>Is CiviCRM's Authorize.net implementation affected?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2019-01-24T20:53:44.773Z
Comments.Text: Oops! I did search first, honest! :) Tried to close it as duplicate but apparently it needs more votes.
Comments.UserDisplayName: Laryn
Tags: <payment-processor><authorize.net>
Title: Does Authorize.net's MD5 Hash End-of-Life affect CiviCRM?
ThreadText: # Does Authorize.net's MD5 Hash End-of-Life affect CiviCRM?
  
  (Asked by: username_0 on 2019-01-24)
  
  Regarding:
  <https://support.authorize.net/s/article/MD5-Hash-End-of-Life-Signature-Key-Replacement>
  
  > Authorize.Net is phasing out the MD5 based hash use for transaction response
  > verification in favor of the SHA-512 based hash utilizing a Signature
  > Key. The end of life for MD5 Hash will be done in two phases: Phase 1
  > - Starting later this month to early February 2019, we will remove ability to configure or update MD5 Hash setting in the Merchant
  > Interface. There are no changes to the existing API response.
  >
  > Phase 2 - Stop sending the MD5 Hash data element in the API response.
  > This change will require that applications support the SHA-512 hash
  > via signature key. Dates for phase 2 will be announced later but is
  > expected in the next 2-3 months.
  >
  > When you receive a transaction response from Authorize.Net, it
  > includes the a SHA2 hash element the name and position depend on the
  > API integration method used. The SHA2 has field contains HMAC-SHA512
  > hash that Authorize.Net generated for the transaction.
  
  Is CiviCRM's Authorize.net implementation affected?
  
  **Tags:** payment-processor, authorize.net
  
  > **Comments:**
  > **username_0**: Oops! I did search first, honest! :) Tried to close it as duplicate but apparently it needs more votes.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-01-24. Score: 2 | Accepted answer
  
  There is a [PR](https://github.com/civicrm/civicrm-core/pull/13474) from Monish to remove md5 hash support from Authorize.net payment processor in CiviCRM. Its now merged in master branch and should be part of 5.11 release.
  
  Cheers
  
  Pradeep
  
  
  ---
  
  