Key Encrypting Key (KEK)

PCIComplianceHub · Last updated 22 September 2026

A cryptographic key used to encrypt other keys rather than data. Storing a data encrypting key wrapped under a KEK means the working key is never held in the clear on disk. PCI DSS requires that a key encrypting key be at least as strong as the key it protects, and that it be stored separately from it, since keeping both in the same place defeats the purpose.