According to PCI-DSS requirement 3.5.2:
Secret and private keys used to encrypt /decrypt cardholder data should be stored in one of the following forms at all times:
Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data-encrypting key.
Within a secure cryptographic device (such as a host security module(HSM) or PTS-approved point-of-interaction device).
As at least two full-length key components or key shares, in accordance with an industry-accepted method.
My questions:
How to store Key-Encrypting Key separately from Data-Encrypting Key and is that a best practice?
If we decide to store KEK separately from DEK, then should we need to store DEK in a server and KEK in a separate server?
If we decide to store keys in a cryptographic device, then which will be a best practice among HSM and PTS?
What is two full-length key components or key shares? Could anyone explain about it?
Is there any useful links or documents available?