Algorithm
PCIComplianceHubLast updated
A defined sequence of steps that turns an input into an output. In PCI DSS the word almost always means a cryptographic algorithm: the specified mathematical process behind encryption, hashing or signing, whose strength, together with key length and key management, is what makes cryptography strong or weak in the standard's terms.
Applies to. PCI DSS v4.0.1 names no algorithm in its requirement text; it asks for strong cryptography and leaves the choice to the entity. Algorithms surface as things to document and check: 3.5.1 and 3.5.1.1 have the assessor examine the encryption algorithms used to render stored PAN unreadable, whether by encryption or keyed hash, 3.6.1.1 requires service providers to list all algorithms, protocols and keys used to protect stored account data in a cryptographic architecture document, with key strength and expiry date, and 4.2.1 requires that the protocol protecting PAN in transit cannot fall back to insecure versions, algorithms or key sizes. 6.2.4 adds the software side: developers of bespoke and custom software must prevent attacks that exploit weak, insecure or inappropriate algorithms, cipher suites or modes of operation.
Limits. The Council's threshold for strong cryptography is an industry-tested and accepted algorithm with at least 112 bits of effective key strength, with NIST SP 800-57 as the reference; the standard never lists which algorithms pass or fail.