Key management scheme in PHP that is compliant with NIST SP 800-57

Question

We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management

I wonder if there're any open-source or commercial PHP solutions available that implement a key management scheme that would comply with the PCI DSS security standard?

We'll be storing card and required to have an encryption key which is NIST SP 800-57 compliant. I have been searching on this but cannot find any sample code or even a single valid key.

Answer 1

NIST SP 800-57 is a long and very general standard, applying primarily to details such as key purpose, length, lifetime, and other details that are typically independent of the application in use. Perhaps you should review that standards documentation, identify the requirements relevant to the your application, and narrow your question to reflect the specific requirements that your application needs to implement.

Note that finding an application written specifically to implement key and password management best practices doesn't make a whole heap of sense, since key and password management needs to be integrated into the application that actually uses the passwords and keys, rather than a stand-alone solution. So it's unclear what an application specifically for enforcing key lifetime, length, etc., would actually do, and how it would fit into your general workflow.

Also key management practices are as much about configuration, usage, and deployment of your application as they are about the code itself, and probably significantly more so.

Answer 2

While PCI DSS does not specifically require NIST SP-800-57 compliance for key management, it does make reference to NIST and other international standards in this area (see the PCI DSS Glossary and Navigation Guide). Deploying a key management solution that is NIST certified goes a long ways towards complying with PCI DSS. Minimally you should look for a FIPS-140-2 Validation of the key manager. Vendor solutions that are validated can be found here:

http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm

You need to exercise some caution about vendor claims for FIPS-140-2 compliance. It is not enough that a key management component is FIPS-140-2 certified. If the vendor's solution is not on the NIST web site, it isn't NIST validated.

PCI DSS makes reference to other key management best practices such as dual control, separation of duties, and split knowledge. These are described reasonably well in the PCI DSS navigation guide. Well worth taking a quick read. These concepts also come from NIST publications and security best practices.