PCIP Encryption Standards 4 — Questions and Answers
Question 1: Which of the following is a valid method to render PAN data unreadable at rest, as accepted by PCI DSS Requirement 3.5?
- Base64 encoding
- Strong one-way hashing of the full PAN (Correct answer)
- Storing PANs in a CSV file on a secure server
- Password-protecting a spreadsheet containing PANs
Correct answer: Strong one-way hashing of the full PAN
PCI DSS Requirement 3.5 accepts strong one-way hashing (using keyed hashes or approved algorithms) as a method to render PANs unreadable at rest.
Question 2: What is 'key splitting' (also called secret sharing) in the context of PCI DSS key custodianship?
- Dividing a key into multiple components so no single custodian holds the complete key (Correct answer)
- Encrypting the same data with two different keys
- Using half the key length to improve performance
- Sharing an encryption key via a secure email
Correct answer: Dividing a key into multiple components so no single custodian holds the complete key
Key splitting divides a cryptographic key into two or more components distributed to different custodians, ensuring no single person can reconstruct the full key alone.
Question 3: Which Elliptic Curve Cryptography (ECC) curve is most commonly recommended by NIST for use in payment security at equivalent-to-RSA-2048 security strength?
- P-192
- P-256 (Correct answer)
- P-521
- Curve25519 only
Correct answer: P-256
NIST P-256 (secp256r1) provides roughly equivalent security to RSA-2048 and is the most commonly specified curve in payment and TLS contexts.
Question 4: What does a Hardware Security Module (HSM) primarily protect in a payment encryption environment?
- Network traffic between servers
- Cryptographic keys, performing key operations inside tamper-resistant hardware (Correct answer)
- Database records containing PANs
- TLS certificates on web servers
Correct answer: Cryptographic keys, performing key operations inside tamper-resistant hardware
An HSM is a tamper-resistant hardware device that securely stores cryptographic keys and performs key operations (encryption, signing) without exposing key material to the host system.
Question 5: Under PCI DSS, which of the following is a requirement for cryptographic key custodians?
- They must be third-party auditors
- They must sign a form acknowledging their key custodian responsibilities (Correct answer)
- They must hold keys in plaintext for audit purposes
- They must rotate keys daily
Correct answer: They must sign a form acknowledging their key custodian responsibilities
PCI DSS requires that key custodians formally acknowledge (typically by signing a form) their understanding of and responsibility for the key custodian role.
Question 6: What is the primary risk of using a static, hardcoded encryption key embedded in application source code?
- The key cannot be used for AES encryption
- Any person with source code access can decrypt all protected data (Correct answer)
- Hardcoded keys automatically expire
- It causes performance degradation
Correct answer: Any person with source code access can decrypt all protected data
A hardcoded key in source code is exposed to anyone who can access the repository or binary, allowing full decryption of all data protected by that key.
Question 7: Which of the following describes 'truncation' as a PAN protection method under PCI DSS?
- Replacing PAN digits with random tokens
- Removing a segment of the PAN so the full number is never stored (Correct answer)
- Hashing the PAN with a secret key
- Encrypting the PAN with AES-256
Correct answer: Removing a segment of the PAN so the full number is never stored
Truncation removes a portion of the PAN (e.g., storing only the last four digits) so the complete PAN is never present in the stored data.
PCIP Encryption Standards 4
Which of the following is a valid method to render PAN data unreadable at rest, as accepted by PCI DSS Requirement 3.5?