PCIP Encryption Standards 5

Question 1

In a tokenization system used to meet PCI DSS requirements, what must be true of the token value itself?

Accepted Answer

It must have no exploitable relationship to the original PAN

Answer

A compliant token must have no mathematical or exploitable relationship to the original PAN, so that the token alone cannot be used to derive the real card number.

Question 2

What is the significance of the 'cryptoperiod' concept in PCI DSS key management?

Accepted Answer

The defined period during which a key is authorized for use

Answer

Cryptoperiod is the authorized time span during which a key may be used; limiting it reduces the volume of data exposed and the window of attack if a key is compromised.

Question 3

Which attack does the use of a keyed-hash message authentication code (HMAC) protect against when hashing PANs?

Accepted Answer

Brute-force cracking of the PAN from the hash using precomputed rainbow tables

Answer

HMAC-based PAN hashing incorporates a secret key, so rainbow table attacks against known PAN hash values are defeated because the attacker must also know the key.

Question 4

What does PCI DSS require if an organization discovers that a cryptographic key has been or is suspected to have been compromised?

Accepted Answer

Immediately retire the compromised key and re-encrypt all data protected by it

Answer

PCI DSS requires immediate retirement and replacement of a suspected compromised key and re-encryption of all data that was protected by that key.

Question 5

Which of the following correctly describes a 'format-preserving encryption' (FPE) scheme such as FF3-1?

Accepted Answer

Encryption that produces ciphertext in the same format and length as the plaintext

Answer

Format-preserving encryption (e.g., FF3-1) produces ciphertext that matches the format and length of the plaintext, so a 16-digit PAN encrypts to a 16-digit ciphertext.

(PCIP) Payment Card Industry Professional Practice Test

(PCIP) Payment Card Industry Professional Practice Test

PCIP Encryption Standards 5