Cryptographic Key Generation

Applies to. Requirement 3.7.1 applies to any entity that generates keys to protect stored account data, whether the keys encrypt PAN directly, encrypt other keys, or drive the keyed hashes allowed by 3.5.1.1. The assessor examines the documented procedure and observes the generation method, so the process has to be repeatable and visible, not a one-off done by a developer. Service providers that generate keys shared with customers also owe those customers guidance under 3.7.9.

Example. A merchant's database team needs a new key to encrypt the PAN column. Following the documented procedure, an authorised custodian generates it inside the key management system rather than typing a value into a script, the system records the event, and the resulting key goes straight into the encrypted key store. Copying a key from a spreadsheet would fail 3.7.1.b, where the assessor watches the method in use.

Limits. Generation is only the first step of key management; 3.7.2 to 3.7.8 govern what happens afterwards, and a strongly generated key that is then emailed to a colleague fails on distribution. The requirement does not prescribe a generator or a key length; it asks for strong keys and leaves the method to industry guidance.