Salt

PCIComplianceHubLast updated

Random data that is combined with a password or other sensitive information before being hashed, in order to increase the complexity and security of the hash. Salting is a recommended practice for protecting stored passwords and maintaining PCI DSS compliance.

Applies to. PCI DSS v4.0.1 does not use the word salt. For stored PAN, Requirement 3 asks for more than one: hashes must be keyed cryptographic hashes of the entire PAN with the key managed under the key-management controls, the difference being that a key is secret and controlled while a salt is stored beside the hash and only defeats precomputed tables. For stored passwords, salting before hashing is general practice rather than something the standard spells out; Requirement 8 asks that stored authentication factors be unreadable with strong cryptography and leaves the method to the entity.
Limits. A salted but unkeyed hash of PAN does not satisfy Requirement 3's keyed-hash rule.
Related. Hashing, Keyed Cryptographic Hash, One-way Hash, Password
Sources. PCI DSS v4.0.1 (June 2024)