PCI Requirement 3.6.4 – Cryptographic Key Changes at Cryptoperiod Completion

by Randy Bartels / December 22, 2022

Encryption keys have a lifespan. PCI Requirement 3.6.4 states, “Cryptographic key changes for keys that have reached the end of their cryptoperiod (for example, after a defined period of time has passed and/or after a certain amount of cipher-text has been produced by a given key), as defined by the associated application vendor or key owner, and based on industry best practices and guidelines.” Cryptoperiods are a major topic when…

PCI Requirement 3.6.3 – Secure Cryptographic Key Storage

by Randy Bartels / December 22, 2022

If your organization is storing PCI-related data using encryption, those keys must be stored securely, as PCI Requirement 3.6.3 commands, “Secure cryptographic key storage.” If your key storage is securely stored, has the appropriate protections, and access is limited to the fewest number of people and locations as possible, you prevent your organization from being susceptible to an attack. The PCI DSS further explains, “The encryption solution must store keys…

PCI Requirement 3.6.2 – Secure Cryptographic Key Distribution

by Randy Bartels / December 22, 2022

PCI Requirement 3.6.2 states, “Secure cryptographic key distribution.” Whether it’s placing tamper-proof or tamper-evident packaging on trackable packages or tracking data that you’ve transmitted electronically, any method that your organization is using to transmit keys needs to be done securely. Whether it’s moving keys from generators into production state or to backup, any method that your organization us using to transmit keys needs to be done securely. To further explain…

PCI Requirement 3.6.1 – Generation of Strong Cryptographic Keys

by Randy Bartels / December 22, 2022

PCI Requirement 3.6.1 requires, “Generation of strong cryptographic keys.” It also requires that, “The encryption solution must generate strong keys, as defined in the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms under "Cryptographic Key Generation." The intent of PCI Requirement 3.6.1, according to the PCI DSS, is to “significantly increase the level of security of encrypted cardholder data.” PCI Requirement 3.6.1 is part of the 8 sub-requirements…

PCI Requirement 3.6 – Document & Implement All Key-Management Processes & Procedures for Cryptographic Keys

by Randy Bartels / December 22, 2022

PCI Requirement 3.6 states, “Fully document and implement all key management processes and procedures for cryptographic keys used for encryption of cardholder data.” PCI Requirement 3.6 and its sub-requirements are meant to build your organization’s key management program because, according to the PCI DSS, “The manner in which cryptographic keys are managed is a critical part of the continued security of the encryption solution. A good key management process, whether…