I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure configuration.

On PCI DSS guidance sections says:

Secure transmission of cardholder data requires using trusted keys/certificates, a secure protocol for transport, and proper encryption strength to encrypt cardholder data

From the above, does TLS 1.1/1.2 covers all stated points? 1. Only use trusted keys/certificates (as signed by trusted authorities) 2. A secure protocol for transport 3. A proper encryption strength

So my question would be: 1. Using only TLS (either 1.1 or 1.2) with a secure configuration is enought for compliance (of this point)? 2. If above is not true, the sistem should include additional encryption on top of that?


The short answer: Yes TLS v1.1 and v1.2 are suitable protocols for transmission of cardholder data and unless you have identified a gap in the transmission path (i.e. where TLS will not protect the data from unauthorised access) additional encryption will not be necessary.

There is also the following in the Guidance Notes for control 4.1:

Refer to industry standards and best practices for information on strong cryptography and secure protocols (e.g., NIST SP 800-52 and SP 800-57, OWASP, etc.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.