Do we need to know what hashing algorithm is employed to protect passwords at rest in regard to PCI DSS Requirement 8.2.1?
We're using a wireless access point (Yamaha WLX302) in the development branch of our payment service division.
It has a password-protected admin console where the password is hashed (or encrypted-- we can't tell) at rest. According to PCI DSS Requirement 8.2.1, we are required to verify that passwords are rendered unreadable during transmission or storage.
Our QSA insisted that we were required to identify the hash/encryption algorithm but since the manual didn't say anything about algorithm and the password hashes were completely hidden from the console*1, we asked the vendor what algorithm was used to securely store the admin password. The vendor did not agree to disclose the algorithm in use.
So, the questions are:
- Do we actually need to identify the hash algorithm of the passwords to be PCI-compliant?
- Can we still be PCI-compliant without an administrative access to the password hashes?
2.1. Since we can't see the passwords/hashes, we can't tell if they're even properly hashed*2. Are we still covered?
*1: This prevents even the admin from viewing the hashed passwords so we have absolutely no idea in what format the passwords are at rest-- hence they're indeed unreadable, I think.
*2: At least we can instruct via the console command to encrypt the passwords at rest, but what if there's a security bug that all passwords are actually stored in plaintext regardless of the configuration?