One-way Hash
PCIComplianceHubLast updated
A cryptographic function that takes an input and produces a fixed-size output, often referred to as a hash, which is unique for each unique input. One-way hashes are designed to be irreversible, making it difficult to determine the original input from the hash value. In the context of PCI DSS, one-way hashing can be used to protect stored cardholder data by rendering it unreadable.
Applies to. Requirement 3 lists a one-way hash of the entire PAN, based on strong cryptography, as one of four accepted methods for rendering stored PAN unreadable, and adds that the hash must be a keyed cryptographic hash with its key managed under the standard's key-management controls; assessors examine the hashing method, the key-management procedures, the data repositories and the audit logs. Where a hashed and a truncated version of the same PAN both exist, the entity must show the two cannot be correlated to reconstruct it.
Limits. Requirement 3 states that hashing cannot be used to replace the truncated segment of a PAN, so hashing and truncation are alternatives, not a combination. An unkeyed hash of PAN, however strong the function, no longer meets the requirement.
Sources. PCI DSS v4.0.1 (June 2024)