4

A question with a similar title has been asked before, but it doesn't answer my specific question here. PCI DSS permits storage of truncated and encrypted data, or hashed and encrypted data. It explicitly states that hashed and encrypted data should not be stored together due to the possibility of breaking the hash.

Truncated data is permitted to be first 6, last 4 of the 16 digit credit card number such that the middle 6 digits are masked.

If I were to store the first 6 and last 4 in clear text and encrypt the middle 6 only, is this less secure than storing the truncated data as well as the full encrypted PAN?

Improve this question
3
  • It would help to understand a bit more your need to store the full PAN in first place. You can display and store in clear the first six and last 4 digits of the PAN. Most of the time it is what you'll need to display card information to customer or lookup card details in database. Full PAN are mainly required when sent to payment provider for payment (and in some cases refund), which doesn't occur as often (except if you are yourself a payment provider). Think what would be the less costly in term of PAN access in your business model.
    – Moustache
    Commented Jun 20, 2013 at 10:41
  • @Moustache The requirement is to store full PAN. It's the level of assurance provided by encryption of middle 6 versus encryption of full 16 that I'm querying.
    – AndyMac
    Commented Jun 20, 2013 at 10:45
  • @AndyMac Kindly please refrain from making incorrect edits
    – techraf
    Commented Feb 8, 2017 at 3:44

1 Answer 1

Reset to default
1

Assuming you are using a modern database and you don't care about the size of the ciphertext, as long as your are using strong encryption algorithm and have key management in place it doesn't really matter.

If you decide to encrypt only the 6 middle digits make sure you are NOT using a Format Preserving Encryption algorithm as it will limit the amount of possibilities and it would probably be possible under some condition to generate all the possible ciphertext.

This article might interest you regarding the FPE issue when encrypting only the 6 middle digits.

Improve this answer
2
  • Thanks @moustache That's all I wanted to know. So encryption of the data provides the necessary level of encryption and security regardless of the size of the data being encrypted and so long as that size is not published/available.
    – AndyMac
    Commented Jun 20, 2013 at 11:33
  • 1
    @AndyMac With a stream cipher, the encrypted length is equal to the plain data length (RC4 for example). A block cipher (AES for example) encrypts a single block of data of a fixed length, depending of the mode used (chaining mode for example), the data may require some padding, i.e. a few extra bytes added at the end so that the length is appropriate for the chaining mode. The encrypted length will then differ from the clear text length.
    – Moustache
    Commented Jun 20, 2013 at 11:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .