What does the PCI-DSS statement "Store separately from the data encrypting key" mean?

Question

As per the PCI-DSS 3.5.2 requirement

Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data encrypting key.

Does this mean:

1. Storing the keys(DEK and KEK) in different servers(server1 and server2) or
2. Storing the keys(DEK and KEK) in different location path on the same machine.

path1(DEK): c:\user\chandru\Document\DEK\DEK.txt

path2(KEK): c:\user\chandru\Document\KEK\KEK.txt

or 3. Storing the keys(DEK and KEK) in different user location on the same machine.

path1(DEK): c:\user\chandru\Document\DEK\DEK.txt path2(KEK):c:\user\somenewuser\Document\KEK\KEK.txt

Is there any other way to store the key apart from the HSM as per the PCI-DSS standards?

Dedicated Server with HSM:

Two dedicated server without HSM:

Answer 1

There's two ways to do this:

Simple storage-only approach

The first method is to use one device for encrypting the data, and another device for storing it. So data gets encrypted on some application server, but gets stored on a database server. The place where the data is stored does not posses any of the keys, it's just storage.

More complex but more secure approach

The second method is to use a public/private keypair. A unique, random session key is generated for every piece you want to encrypt. You encrypt the sensitive data with the session key, and the session key with your public key, and then discard your session key.

You can then store the encrypted block on the same server as the public key that was used to encrypt it, since the public key is useless for decryption.

To decrypt your data, you use the private key to decrypt your session key, and use the session key to use decrypt the sensitive data.

This is how tools like PGP/GPG work, so you don't need to (and shouldn't) implement it yourself, you can just use one of these stock utilities.

Answer 2

So you have 2 questions

What does stored separately in the 3.5.2 requirement mean?

"Separate" means, well, separate, so as far as that particular requirement is concerned, your 1rd, 2nd, 3rd methods are all fine. However in other requirements (e.g. read all of Requirements 3.5 & 3.6) PCI-DSS wants you to make sure your key storage is secure, so you don't just need to separate the KEK from the DEK, you must store the KEKs securely (e.g. in a HSM, or a software based key store)

Is there any other way to store the key apart from the HSM as per the PCI-DSS standards?

Of course yes, the PCI-DSS standard doesn't require you to use a HSM for key storage. As long as your key (the KEKs) storage is secure, you're fine. In our projects we use exactly your "Two dedicated server without HSM" approach. Be noted that your "Key Server" should actually provide both key storage function and encryption/decryption function (thus should be called something else). That way, your KEKs (your most "precious" keys) are never exposed to the client code (applications running on Application Server in our diagram).