Weak Cryptography
PCIComplianceHubLast updated
The use of cryptographic algorithms or key lengths that are no longer considered secure due to advances in computing power or the discovery of vulnerabilities. Using weak cryptography can put cardholder data at risk and may result in non-compliance with PCI DSS requirements.
Applies to. PCI DSS v4.0.1 defines the positive term, strong cryptography, and treats anything short of it as weak; the Council's floor is an industry-tested and accepted algorithm with at least 112 bits of effective key strength, following NIST SP 800-57. The standard meets weak cryptography in three places: Requirement 4 forbids transmission protocols that fall back to insecure versions, algorithms or key sizes, Requirement 6 asks developers of bespoke and custom software to prevent attacks that exploit weak, insecure or inappropriate cryptographic implementations, algorithms, cipher suites or modes of operation, and Requirement 12 requires an annual review of cipher suites and protocols in use with monitoring of industry trends on their continued viability and a plan for responding to anticipated cryptographic vulnerabilities.
Limits. The standard publishes no list of weak algorithms and no sunset dates; what counts as weak moves with industry consensus, which is what the annual review under Requirement 12 is for.
In PCI DSS v4.0.1. 6.2.4