Suppose we have web and application servers and trying to encrypt credit card information for our financial web application. Communication between web and app servers are secured through SSL/TLS. Lets say encrypted data is needed in the web server which will be sent to the application server to be secured. Is there a difference between these two approaches:
- Getting the encryption key from application server (which obtains the key from HSM) and encrypting data in the web server.
- Sending non-encrypted data to the application server which encrypts data using the key obtained from HSM and returns it back to the web server.
Details about the environment
We are trying to achieve PCI-DSS certificate for our virtual POS application. Web server is open to internet outside communication is also secure (SSL). Application server contains the business logic and only accessed by the web server. You can assume that all other security criterias for PCI-DSS is ensured.