Mryntu

I'm using Authorize.net payment method which is by default provided by Magento.

Recently Authorize.net going to upgrade transaction hash. So, do I need to change anything in my Magento ?

https://developer.authorize.net/support/hash_upgrade/

Solution: Check out the latest update with patches from the Magento site regarding this issue: https://support.magento.com/hc/en-us/articles/360024368392 This solves the issue! For community editions download the patch from https://magento.com/tech-resources/download for magento 1 check for Authorize.net Direct Post Signature Key patch in Release Archive and for version 2 in Magento Open Source Patches - 2.x

Authorize.Net phases out MD5 based hashes used for transaction response verification. Phase 1 means that merchants are no longer able to configure or update their MD5 Hash settings in the Merchant Interface. This will have severe impacts on merchants who use or are interested in using the Authorize.Net Direct Post method in Magento. So if you are not using Authorize.Net Direct Post method in magento you don't have to worry.

If you want to fix the directpost method you will have to do redo the hash calculation with the new APISignatureKey :

 $hash_data = "^" .$merchantApiLogin . "^" . $transactionId . "^" . $amount."^" ;
 $local_hash = hash_hmac("sha512", $hash_data, pack("H*", $APISignatureKey));

and then the hash validation with transHashSHA2 instead of x_MD5_Hash.

The issue of the delimiter character has nothing to do with this!

By the way the mentioned Vonnda patch https://github.com/vonnda/Vonnda_AuthorizePatch/ is not related to this md5 upgrade issue, it addresses in a wrongful manner the following issue: https://community.magento.com/t5/Magento-1-x-Technical-Issues/Authorize-net-Gateway-Errors-without-Message/m-p/119112/highlight/true#M9284 which was fixed by Zoey see here https://blog.zoey.com/important-authorize-net-problem-may-mean-missed-orders

First Please check this link for reference discussion about Authorize.net change MD5 to SHA-512 by Magento Maintenance support

https://www.vonnda.com/blog/magento-maintenance-services-getting-caught-by-the-safety-net/

For Magento 1.9 here is possible fix for (a change made regarding the support of the delimiter character from any string to only a single character).

https://github.com/vonnda/Vonnda_AuthorizePatch/

For Magento 2

The new official Magento 2 core module that is nearing completion and
is scheduled to be available in 2.3.1 will support the new algorithm
as well as the old. Authorize.net documentation states that both will
continue to function but the old md5 option will no longer be in their
interface

I hope this will help

This statement is incorrect! "So if you are not using Authorize.Net Direct Post method in magento you don't have to worry." We are using Authorize.net in Magento 1.9 completely patched with SUPEE 11085 just in case and I can confirm that as of 3-16-19, our site is now broken over this issue. Trying to figure out how to implement the SHA-512 Signature key in Authorize.net transactions or else be forced to go to DPM.