PCIP Encryption Standards 2 — Questions and Answers
Question 1: Which key length is the minimum recommended by PCI DSS for RSA asymmetric encryption used to protect cardholder data?
- 1024-bit
- 2048-bit (Correct answer)
- 4096-bit
- 512-bit
Correct answer: 2048-bit
PCI DSS requires a minimum RSA key length of 2048 bits for asymmetric encryption protecting cardholder data.
Question 2: In the context of PCI DSS, what does the term 'key-encrypting key' (KEK) refer to?
- A key used to encrypt cardholder data directly
- A key used to encrypt other cryptographic keys (Correct answer)
- A session key generated per transaction
- A public key shared openly with merchants
Correct answer: A key used to encrypt other cryptographic keys
A key-encrypting key (KEK) is used solely to encrypt or wrap other cryptographic keys, not cardholder data directly.
Question 3: Which cipher mode makes AES encryption deterministic and therefore unsuitable for encrypting PANs directly under PCI DSS guidance?
- CBC
- GCM
- CTR
- ECB (Correct answer)
Correct answer: ECB
ECB (Electronic Code Book) mode produces identical ciphertext for identical plaintext blocks, making it deterministic and cryptographically weak for PAN protection.
Question 4: What is the primary purpose of an Initialization Vector (IV) in symmetric encryption schemes?
- To increase the key size
- To authenticate the sender's identity
- To ensure identical plaintexts produce different ciphertexts (Correct answer)
- To compress data before encryption
Correct answer: To ensure identical plaintexts produce different ciphertexts
An IV introduces randomness so that encrypting the same plaintext twice with the same key produces different ciphertexts, preventing pattern analysis.
Question 5: Which protocol version is explicitly prohibited by PCI DSS 4.0 for protecting cardholder data in transit?
- TLS 1.2
- TLS 1.3
- SSL 3.0 (Correct answer)
- TLS 1.1
Correct answer: SSL 3.0
SSL 3.0 (and all SSL versions) are explicitly prohibited by PCI DSS 4.0 due to known vulnerabilities such as POODLE.
Question 6: In PCI DSS key management, what is 'dual control'?
- Encrypting data twice with two different keys
- Requiring two separate individuals to perform a single sensitive key operation (Correct answer)
- Using two different encryption algorithms simultaneously
- Splitting a key across two hardware devices
Correct answer: Requiring two separate individuals to perform a single sensitive key operation
Dual control requires two separate, authorized individuals to perform a single sensitive cryptographic key operation, preventing any single person from having complete access.
Question 7: What is the role of a Certificate Authority (CA) in asymmetric encryption environments used for payment systems?
- Generating session keys for each transaction
- Signing digital certificates to bind public keys to verified identities (Correct answer)
- Storing private keys on behalf of merchants
- Performing the actual encryption of cardholder data
Correct answer: Signing digital certificates to bind public keys to verified identities
A CA issues and signs digital certificates, cryptographically binding a public key to a verified entity identity so relying parties can trust the key's authenticity.
PCIP Encryption Standards 2
Which key length is the minimum recommended by PCI DSS for RSA asymmetric encryption used to protect cardholder data?