3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length key components or key shares, in accordance with an industry accepted method
Could you let me what the full-length key components,what is relationship with secret and private keys store? AS a QSA how to Verify if the The audited party meet the condition？ Thanks a lot~
Key components: Let's say you've a symmetric encryption key. To backup the key and achieve split knowledge, you export the key as separate components.
If the key is a 128-bit key, you should get key components which are each 128-bits in length. You can have two or more components. These components can be XOR'd together (a bitwise operation) to recreate the initial encryption key.
These key components should be under the responsibility of different individuals (i.e. key custodians).
With the above, you have split knowledge - no single individual knows the full key and knowledge of a single component provides no means to derive the original key.
You also have dual control - at least two individuals are required in order to recreate the encryption key.
The key store relates to where the key is located - e.g. the data encryption key is likely stored as a cryptogram encrypted with a key encryption key of equal or greater strength.
Verification is typically through review of a documented process, interviews with key custodians, review of logs of key generation and component storage locations.
IANAQSA but I believe this is referencing Split Keys.
NIST SP800-57 is likely the sort of acceptable standard the PCI SSC had in mind. To quote:
6.2.1.3 Confidentiality
....If confidentiality protection is required, the keying material shall be protected using one or more of the following mechanisms:
- Manual method:
...
-OR-
(b) The keying material is separated into key components, with each key component being generated at a security strength that meets or exceeds the security strength required of the keying material. Each key component is handled, using split knowledge procedures (see Sections 8.1.5.2.1 and 8.1.5.2.2.1), so that no single individual can acquire access to all key components.
and
8.1.5.2.1 Key Generation
...
When split-knowledge procedures are used, the key shall exist outside of a [FIPS140] cryptographic module as multiple key components. The keying material may be created within a cryptographic module and then split into components for export from the module, or may be created as separate components. Each key component shall provide no knowledge of the key value (e.g., each key component must appear to be generated randomly). If knowledge of k components is required to construct the original key, then knowledge of any k-1 key components shall provide no information about the original key other than, possibly, its length.
I have not seen split keys implemented, and have never had reason to discuss them with a QSA, so I cannot give you more practical guidance as to what sort of implementation would pass QSA muster. You may want to consider posting this question to Crypto.SE which is more focused to this level of detail.
Sounds like two keys used within a key sharing scheme. For instance, you could have two keys K0 and K1 which, when XOR'ed together form the protected key. Of course both keys need to be the same (full) length of the original key.
In that case you need both keys. There are also 2 out of 3 schemes etc., a so called threshold scheme such as Shamir's secret sharing.
Of course you could also split keys by cutting them into parts and share those. In that case the keys are smaller in size. This would also mean that it is easier to guess the remaining bits from just one key share. In other words, the keys need to be full size to maintain the same level of security as the key to protect. More information in the Wikipedia article.
