Encryption Algorithm

Applies to. PCI DSS v4.0.1 never names an algorithm in its requirements; it requires strong cryptography and leaves selection to the entity. Assessors do ask which algorithm is in use: 3.5.1.a has the assessor examine documentation of the encryption algorithms used to render PAN unreadable, and 4.2.1 requires that transmission protocols do not fall back to insecure algorithms or key sizes. Service providers list every algorithm in their cryptographic architecture document under 3.6.1.1.

Example. A merchant asks its database vendor which algorithm the column encryption feature uses and records the answer, the key length and the key-management steps in its PCI documentation. When a later review flags that the algorithm has been deprecated by industry bodies, the response plan required by 12.3.3 tells the merchant how and when to migrate.

Limits. An algorithm is only one input to strong cryptography; key length, correct implementation and key management decide whether the result qualifies, and an accepted algorithm with a weak key fails. Encryption algorithms are reversible with the key; hash functions have no key to recover the input, and 3.5.1 treats the two as separate methods. 12.3.3 tracks cipher suites and protocols, which combine several algorithms, so the inventory it asks for is broader than a list of encryption algorithms.