Encryption
PCIComplianceHubLast updated
The reversible transformation of data into ciphertext with an encryption algorithm and a key, so that only a holder of the matching key can read it. Encryption protects confidentiality; proving that data was not altered, or who sent it, takes a message authentication code or a digital signature. Under PCI DSS it counts as strong cryptography only when the algorithm, the key length and the key management all meet the Council's threshold.
Applies to. Requirement 3.5.1 lists strong cryptography with key management as one of four ways to render stored PAN unreadable, alongside one-way hashing, truncation and index tokens, and 3.3.2 requires encryption with strong cryptography for any SAD stored before authorisation. Requirement 4.2.1 requires strong cryptography for PAN sent over open, public networks and 2.2.7 for non-console administrative access. Where disk or partition encryption is used for stored PAN, 3.5.1.2 and 3.5.1.3 add restrictions on when it may be relied on and how access to it is controlled.
Example. An online retailer stores PAN for subscriptions in a database column encrypted with a data-encrypting key, on a server whose disks are also encrypted at the volume level. At assessment the column encryption, with its key-management procedures, is what satisfies 3.5.1; the volume encryption alone would not, because 3.5.1.2 accepts disk-level encryption on its own only for removable media.
Limits. Encryption hides content; it does not by itself prove integrity or origin, which is the job of a message authentication code or digital signature. Under 3.5.1, encryption counts only when strong cryptography is paired with key-management processes; the algorithm alone earns nothing. Encryption is reversible, which is what separates it from one-way hashing and from truncation, and masking under 3.4.1 is a display control rather than a transformation of stored data.