I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS.
We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the encryption. Key generation occurs within the application and is derived from a password set by the user. The password is read at application initialisation from a config. file. The encryption system used is provided by jasypt PBE methods.
I'm unclear how such a system should be managed for PCI-DSS compliance.
Q1: Should the password above be considered to be the "key encrypting key"?
Q2: Is PCI-DSS requirement 3.6.6 "If manual clear-text cryptographic key management operations are used, these operations must be managed using split knowledge and dual control (for example, requiring two or three people, each knowing only their own key component, to reconstruct the whole key)." relevant in this case and if so how could this be implemented?
I'm concerned about the need for compliance to 3.6.6 affecting our rapid development iteration and deployment cycle.