Cipher
PCIComplianceHubLast updated
An algorithm for encrypting and decrypting data: the mathematical procedure that, with a key, turns readable data into ciphertext and back. Ciphers are named in the cipher suites a TLS connection negotiates, which is what 4.2.1 is checking when it asks that only trusted keys and certificates, secure protocols and strong cryptography are used to protect PAN in transit, and what 12.3.3 asks an entity to inventory and review at least annually.
Applies to. 12.3.3 requires an inventory of all cryptographic cipher suites and protocols in use, with purpose and where used, active monitoring of industry trends on their continued viability, and a documented plan for responding to anticipated cryptographic vulnerabilities, reviewed at least once every 12 months. 6.2.4 requires developers of bespoke and custom software to prevent attacks that exploit weak, insecure or inappropriate cipher suites or modes of operation. The standard names no cipher; whether one is acceptable is decided by the Council's definition of strong cryptography, not by the requirement text.
Limits. 12.3.3 is a documentation and review control: it does not itself require any cipher to be replaced, only that the entity knows what it runs, watches for its weakening and has a plan to respond.
Related. Strong Cryptography, Encryption Algorithm, Transport Layer Security (TLS), Ciphertext, Cryptography
Sources. PCI DSS v4.0.1 (June 2024)