Key Management
Also: Cryptographic Key Management
PCIComplianceHubLast updated
The process of managing cryptographic keys, including their generation, distribution, storage, use, and disposal. Key management is crucial in ensuring the security of encrypted data, including cardholder data in the context of PCI DSS. Proper key management practices help maintain the confidentiality and integrity of sensitive data and are required for PCI DSS compliance.
Applies to. Requirements 3.6 and 3.7 set the key-management obligations for keys used to protect stored account data, including keys behind keyed hashes under 3.5.1.1. 3.7.1 to 3.7.8 each require a documented and implemented policy for one lifecycle stage: generation, distribution, storage, change at the end of the cryptoperiod, retirement or destruction, split knowledge and dual control for manual cleartext operations, prevention of unauthorised substitution, and custodian acknowledgement. Service providers also document their cryptographic architecture under 3.6.1.1 and, if they share keys with customers, give those customers key-handling guidance under 3.7.9.
Example. A merchant encrypting stored PAN writes a key-management procedure that names the custodians, states the cryptoperiod, describes how keys are generated in the key management system and where the key-encrypting key lives, and defines what happens when a custodian leaves. At assessment the procedure is examined against each of 3.7.1 to 3.7.8 in turn, and custodians are interviewed to confirm the steps actually happen.
Limits. Key management is the process around the keys, not the encryption itself: a strong algorithm with an undocumented, never-changed key does not meet 3.5.1, which requires strong cryptography together with key-management processes. Requirements 3.6 and 3.7 do not cover keys used only for transmission; 4.2.1 handles trusted keys and certificates in transit, and 2.3.1 and 2.3.2 handle wireless encryption keys. Buying a hardware security module or key management system does not discharge the requirement; the policies, custodians and records still have to exist.