How to implement PCI-DSS requirement 3.5? (Protect any keys used to secure cardholder data against disclosure and misuse.) I use a JCEKS keystore, passphrase protected, to store my keys (RSA 2048 ...
Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
We're a bootstrapped startup looking to achieve PCI compliance, we've almost nailed all requirements but I recently came across this blog post which totally derails our plans and efforts : ...
We're working on achieving SAQ-D PCI compliance and along the way we're discovering new things each day. Today: Key Management I wonder if there're any open-source or commercial PHP solutions ...
I've inherited the task of self-auditing an e-commerce system for compliance with the PCI-DSS. We are storing the PAN in our database in encrypted form using 256 bit AES algorithm to do the ...
We are relatively small software company who has a requirement to store PAN's for our customers. Hosted payment solutions just don't fit our product requirements. We literally have 3 lines of ...
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there. I've ...
(Full disclosure: I'm already an active participant here and at StackOverflow, but for reasons that should hopefully be obvious, I'm choosing to ask this particular question anonymously). I currently ...