PCIP Encryption Standards 3 ā Questions and Answers
Question 1: Which NIST-approved algorithm is commonly used for hashing PANs to create irreversible tokens under PCI DSS?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- DES
Correct answer: SHA-256
SHA-256 (part of the SHA-2 family) is NIST-approved and produces a 256-bit digest suitable for irreversible PAN hashing; MD5 and SHA-1 are considered weak.
Question 2: When using point-to-point encryption (P2PE), at what point in the transaction flow is cardholder data first encrypted?
- At the payment gateway
- At the merchant's server
- At the point of interaction (POI) device (Correct answer)
- At the acquiring bank
Correct answer: At the point of interaction (POI) device
In P2PE, cardholder data is encrypted immediately at the point of interaction (POI) deviceāsuch as a card readerābefore it ever enters the merchant's environment.
Question 3: What does 'forward secrecy' (also called perfect forward secrecy, PFS) provide in TLS connections for payment systems?
- Faster encryption throughput
- Session keys that cannot be derived even if the server's long-term private key is later compromised (Correct answer)
- Longer key lifetimes to reduce key management overhead
- Automatic certificate renewal
Correct answer: Session keys that cannot be derived even if the server's long-term private key is later compromised
PFS uses ephemeral key exchange so that compromise of a long-term private key cannot be used to decrypt previously captured session traffic.
Question 4: Under PCI DSS, what is the maximum recommended cryptoperiod for a data-encrypting key (DEK) used to protect stored cardholder data?
- One month
- One year (Correct answer)
- Five years
- Indefinitely, as long as the key is not compromised
Correct answer: One year
PCI DSS and NIST SP 800-57 recommend that data-encrypting keys used for stored data have a cryptoperiod of no more than one year.
Question 5: Which of the following best describes 'envelope encryption' as used in cloud-based cardholder data storage?
- Encrypting data with a public key and sending it via email
- Encrypting a DEK with a KEK and storing the wrapped DEK alongside the ciphertext (Correct answer)
- Using multiple layers of hashing before encryption
- Sending encrypted data inside a TLS tunnel
Correct answer: Encrypting a DEK with a KEK and storing the wrapped DEK alongside the ciphertext
Envelope encryption wraps the data-encrypting key (DEK) with a key-encrypting key (KEK), storing the wrapped DEK with the ciphertext so only KEK holders can decrypt.
Question 6: What cryptographic concept does AES-GCM provide that AES-CBC alone does not?
- Larger key sizes
- Authenticated encryption (confidentiality + integrity) (Correct answer)
- Faster key generation
- Public key infrastructure support
Correct answer: Authenticated encryption (confidentiality + integrity)
AES-GCM provides authenticated encryption with associated data (AEAD), offering both confidentiality and integrity/authentication in a single operation.
Question 7: In PCI DSS, which practice is required to prevent the use of the same cryptographic key indefinitely?
- Key escrow
- Key rotation (periodic key change) (Correct answer)
- Key splitting
- Key publishing
Correct answer: Key rotation (periodic key change)
Key rotationāperiodically replacing cryptographic keys with new onesālimits the amount of data exposed if a key is compromised and is required by PCI DSS.
PCIP Encryption Standards 3
Which NIST-approved algorithm is commonly used for hashing PANs to create irreversible tokens under PCI DSS?