PCI-DSS states the following:
3.5 Protect any keys used to secure cardholder data against disclosure and misuse
I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the bcrypt algorithm is adjusted for significant slowness, how does the 3.5 requirement apply to the salt used to calculate the hash? Do I have to protect it like a common data encryption key?