Key Encrypting Key (KEK)
PCIComplianceHubLast updated
A cryptographic key used to encrypt other keys rather than data. Storing a data encrypting key wrapped under a KEK means the working key is never held in the clear on disk. PCI DSS requires that a key encrypting key be at least as strong as the key it protects, and that it be stored separately from it, since keeping both in the same place defeats the purpose.
Applies to. 3.6.1 places the KEK rules inside the documented procedures for protecting keys used for stored account data, alongside restricting key access to the fewest custodians necessary and holding keys in the fewest locations and forms. 3.6.1.2 makes wrapping under a KEK one of three permitted forms for a secret or private key at all times, the others being storage inside a secure cryptographic device such as an HSM or PTS-approved point-of-interaction device, and splitting into at least two full-length key components or key shares by an industry-accepted method; wherever KEKs are used, assessors examine system configurations and key storage locations to confirm the strength and separation rules hold.
Limits. A KEK is not mandatory: an entity that keeps its data-encrypting keys inside a secure cryptographic device or as split components meets 3.6.1.2 without one.
Related. Data Encrypting Key (DEK), Cryptographic Key, Key Management, Hardware Security Module (HSM)
Sources. PCI DSS v4.0.1 (June 2024)