Split Knowledge
PCIComplianceHubLast updated
A control in which a cryptographic key is divided into components and no single person holds enough of them to reconstruct the key. Each custodian knows only their own component. PCI DSS requires split knowledge together with dual control for manual clear-text key management operations, so that no individual can obtain or use a key alone. Split knowledge answers who knows what; dual control answers who must be present to act.
Applies to. Requirement 3.7.6 requires split knowledge, alongside dual control, for manual cleartext key-management operations on keys that protect stored account data. It also underlies one of the three permitted key storage forms in 3.6.1.2: a secret or private key may be held as at least two full-length key components or key shares. 3.6.1.3 then limits access to cleartext key components to the fewest custodians necessary.
Example. A merchant keeps its database master key as two full-length components sealed in separate envelopes, each held by a different custodian in a different safe. At a scheduled key ceremony each custodian retrieves and enters only their own component; the device combines them and neither person ever sees the whole key. The access list examined under 3.6.1.3 names two people per component and nobody on both.
Limits. Cutting a key in two so that each half reveals half the key is not split knowledge; each component must give no information about the final key on its own, which is why 3.6.1.2 asks for full-length components combined by an industry-accepted method. Split knowledge governs knowledge, not presence: dual control is the separate rule that no single person can act alone, and 3.7.6 asks for both. It applies to manual cleartext handling, so keys that live and move only inside secure cryptographic devices do not need a ceremony.