PCIP Encryption Standards 5 — Questions and Answers
Question 1: In a tokenization system used to meet PCI DSS requirements, what must be true of the token value itself?
- It must be encrypted with AES-256
- It must have no exploitable relationship to the original PAN (Correct answer)
- It must be exactly 16 digits like a real PAN
- It must be stored in the same database as the PAN
Correct answer: It must have no exploitable relationship to the original PAN
A compliant token must have no mathematical or exploitable relationship to the original PAN, so that the token alone cannot be used to derive the real card number.
Question 2: What is the significance of the 'cryptoperiod' concept in PCI DSS key management?
- The time required to generate a new key pair
- The defined period during which a key is authorized for use (Correct answer)
- The length of time an HSM can operate without maintenance
- The interval between mandatory TLS certificate renewals
Correct answer: The defined period during which a key is authorized for use
Cryptoperiod is the authorized time span during which a key may be used; limiting it reduces the volume of data exposed and the window of attack if a key is compromised.
Question 3: Which attack does the use of a keyed-hash message authentication code (HMAC) protect against when hashing PANs?
- Brute-force cracking of the PAN from the hash using precomputed rainbow tables (Correct answer)
- Man-in-the-middle interception during transit
- SQL injection into the payment database
- Replay attacks on TLS sessions
Correct answer: Brute-force cracking of the PAN from the hash using precomputed rainbow tables
HMAC-based PAN hashing incorporates a secret key, so rainbow table attacks against known PAN hash values are defeated because the attacker must also know the key.
Question 4: What does PCI DSS require if an organization discovers that a cryptographic key has been or is suspected to have been compromised?
- Notify the card brands and retire the key only after the next scheduled rotation
- Immediately retire the compromised key and re-encrypt all data protected by it (Correct answer)
- Continue using the key while investigating to avoid service disruption
- Archive the key in an HSM for forensic analysis without replacement
Correct answer: Immediately retire the compromised key and re-encrypt all data protected by it
PCI DSS requires immediate retirement and replacement of a suspected compromised key and re-encryption of all data that was protected by that key.
Question 5: Which of the following correctly describes a 'format-preserving encryption' (FPE) scheme such as FF3-1?
- Encryption that always produces output twice the length of the input
- Encryption that produces ciphertext in the same format and length as the plaintext (Correct answer)
- A one-way hash function that cannot be decrypted
- Encryption that strips special characters from the output
Correct answer: Encryption that produces ciphertext in the same format and length as the plaintext
Format-preserving encryption (e.g., FF3-1) produces ciphertext that matches the format and length of the plaintext, so a 16-digit PAN encrypts to a 16-digit ciphertext.
Question 6: Under PCI DSS, why is it insufficient to rely solely on database-level encryption (Transparent Data Encryption, TDE) to protect stored PANs?
- TDE is not approved by any payment brand
- TDE protects data at rest on disk but may expose plaintext PANs to privileged database administrators (Correct answer)
- TDE only works with Oracle databases
- TDE increases query latency beyond acceptable limits
Correct answer: TDE protects data at rest on disk but may expose plaintext PANs to privileged database administrators
TDE encrypts data files on disk, but authorized DBAs and applications accessing the database through normal channels still see plaintext data, so it does not meet PCI DSS requirements for access control on PANs.
Question 7: Which of the following key management practices is explicitly required by PCI DSS to ensure accountability for cryptographic keys?
- Storing all keys in a single, highly secured vault
- Maintaining documented procedures and logs for all key management activities (Correct answer)
- Using only open-source cryptographic libraries
- Rotating keys only when staff turnover occurs
Correct answer: Maintaining documented procedures and logs for all key management activities
PCI DSS requires documented key management procedures and audit logs covering the full key lifecycle—generation, distribution, storage, retirement, and destruction—to ensure accountability.
PCIP Encryption Standards 5
In a tokenization system used to meet PCI DSS requirements, what must be true of the token value itself?