Nonce

PCIComplianceHubLast updated

A unique, one-time value used in cryptographic operations, such as encryption or authentication, to prevent replay attacks. Nonce values can be used to ensure the freshness of a message or transaction and are sometimes employed as part of a secure communication protocol within the context of PCI DSS and information security.

Applies to. PCI DSS v4.0.1 does not name nonces. They sit inside mechanisms the standard does require: the secure protocol versions and configurations Requirement 4 demands for PAN in transit, the modes of operation Requirement 6 asks developers of bespoke and custom software to implement without weakness (in general practice a reused nonce is what breaks an otherwise sound cipher), and the multi-factor authentication systems Requirement 8 requires to resist replay attacks.
Related. Replay Attack, Cipher, Multi-factor Authentication (MFA), Salt
Sources. PCI DSS v4.0.1 (June 2024)