Ciphertext

PCIComplianceHubLast updated

Data after encryption: unreadable without the key that decrypts it. Ciphertext is what PCI DSS wants stored PAN to be under 3.5.1's strong-cryptography option, and what it wants PAN to be on any public network under 4.2.1. Ciphertext is only as protected as its key, which is why Requirements 3.6 and 3.7 are about keys rather than about the encryption.

Applies to. PCI DSS v4.0.1 does not use the word ciphertext; it speaks of PAN being rendered unreadable or protected with strong cryptography. Ciphertext sitting in a database, file or log is still stored account data, so assessors examine data repositories and audit logs, including payment application logs, to confirm the PAN in them is unreadable, and a service provider's cryptographic architecture document must record the algorithms, keys, key strengths and expiry dates behind it.
Related. Cleartext Data, Encryption, Strong Cryptography, Cryptographic Key
Sources. PCI DSS v4.0.1 (June 2024)