PCI-DSS and salt storage

Question

PCI-DSS states the following:

3.5 Protect any keys used to secure cardholder data against disclosure and misuse

I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the bcrypt algorithm is adjusted for significant slowness, how does the 3.5 requirement apply to the salt used to calculate the hash? Do I have to protect it like a common data encryption key?

Answer 1

In my opinion, you don't. The salt cannot be used directly to get the clear PAN back, so it is not subject to requirement 3.5.