I work in a PCI DSS certified environment, which (as many secure environments) require 'Strong Cryptography' when storing user passwords, as per requirement 8.2.1. We simply hash them using BCrpyt.
However, we have a new use case. When a new user is defined to the system, a password is generated automatically and emailed to the user. We want to separate creation of the user/password and emailing processes. When a user is created, we would like to persist the email body to a database, and in a scheduled task, we would like to send emails.
As you could see, this requires storing the email body (including the password in plain text) in the database. So here are my questions:
1. I suspect keeping this data in the database without encryption would not violate PCI DSS requirements, as it is not a
password field but an
email_body field. There's no one-to-one relation. However, it might as well.
2. I could encrypt the
email_body field before persisting it to the database. I could keep the key on the server and the data on the database server (which would comply with PCI DSS requirement 3.5.2). Would this satisfy requirement 8.2.1?
3. Or simply I have to send the password as I create it, and forget all about.