PCI SSCPCI DSSEncryptionEASYFree question
What does PCI DSS mean by 'strong cryptography'?
- A.Cryptography based on vendor-designed and proprietary algorithms with short key lengths, such as a 64-bit custom cipher, along with a signed attestation from the vendor
- B.Cryptography based on legacy and deprecated algorithms with fixed key lengths, such as 3DES with 112-bit keys, along with a documented exception from the assessor
- C.Cryptography based on industry-tested and accepted algorithms with sufficient key lengths, such as AES-128 or higher, along with proper key management
- D.Cryptography that hides data from casual readers, such as Base64 encoding and ROT13, along with a masked display of the PAN
Why C is correct
Strong cryptography uses industry-tested algorithms like AES with key lengths of 128 bits or higher, combined with proper key management practices.
Know someone studying for PCI DSS? Send them this one.