RSA
PCIComplianceHubLast updated
A widely-used public key cryptosystem that enables secure data transmission and digital signatures. RSA can be used to protect cardholder data and support PCI DSS compliance by ensuring the confidentiality, integrity, and authenticity of data and communications.
Applies to. PCI DSS v4.0.1 does not name RSA; like AES it sits under strong cryptography, and the standard leaves algorithm choice to the entity. RSA is an asymmetric algorithm, so where it appears in a payment environment it is usually in the certificates and key exchange behind the protocols 4.2.1 covers for PAN in transit, and in private keys that 3.6.1.2 requires to be stored encrypted, in a secure cryptographic device, or as key components. Service providers list it, with key strength, in the cryptographic architecture document under 3.6.1.1.
Example. A merchant's web server presents a certificate whose key pair was generated with RSA. The private key sits in a hardware security module rather than in a file on the web server, the certificate is checked for expiry and revocation as 4.2.1 expects, and the key size is recorded so that the review under 12.3.3 can flag it if industry guidance moves.
Limits. The name RSA carries no assurance by itself: whether a given RSA key provides strong cryptography depends on its length and on how the private key is generated, stored and changed, and the standard's threshold is stated as effective key strength, not as an algorithm. In practice RSA is not the algorithm that encrypts stored PAN; it protects keys, sessions and signatures, and a symmetric algorithm does the bulk work.