Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : http://securology.blogspot.in/2008/12/stupidest-pci-requirement-ever.html

"Consider an automated e-commerce system. The notion of automation means it works on its own, without human interaction. If that e-commerce system needs to process or store credit card numbers, it will need to encrypt and decrypt them as transactions happen. In order to do those cryptographic functions, the software must have access to the encryption key. It makes no sense for the software to only have part of the key or to rely on a pair of humans to provide it a copy of the key. That defeats the point of automation."

.. so we can't process payments automatically on monthly billing date using the stored cardholder data? Do we both have to enter keys for EVERY transaction, thats just impossible right?

share|improve this question
add comment

1 Answer

You CAN use stored keys and DO NOT have to enter keys manually, but you also must rotate (change) keys every quarter, and a separate key for each customer is a good idea, too.

share|improve this answer
    
Ah, I just let out a biggest sigh! :) So what if we didn't store the keys at all and just manually entered them on application startup? btw, some authoritative reference if possible would be great. –  Nimbuz Dec 16 '12 at 3:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.