0

According to PCI-DSS requirement 3.5.2:

We should store secret keys in a cryptographic device.

Cryptographic devices:

1.HSM

2.PTS-approved point of interaction device

My questions:

I have some knowledge about HSM and it encrypts the KEK using Master key. Also read about Thales HSM and I'm aware about it. But when I was looking into PTS, I can't understand it.

  1. What is PTS and is that a device like a HSM?

  2. How does PTS differs from HSM?

  3. Which is the best practice among HSM and PTS?

Improve this question

1 Answer 1

Reset to default
2

Very, very simple and in very simple words:

  1. HSM: is an appliance that manages keys. HSM Applicane
  2. PTS: is basically a card reader which allows you to enter a PIN number. PTS Device

I forgot to "actually" answer the other two questions but I guess that an image is worth a thousand words =)

Improve this answer
4
  • What you show is a PoS (Point of Sales), not a PTS. PTS is the name of the PCI spec that applies to PoS (and PoI in general).
    – Gilles 'SO- stop being evil'
    Feb 25, 2014 at 20:31
  • @Gilles I believe he refers to the so called in the PCI-DSS PTS-dev, but I might be wrong.
    – kiBytes
    Feb 25, 2014 at 20:39
  • @kiBytes Could you please confirm that second image you have mentioned for PTS is POS or PTS....does POS and PTS are same
    – RajeshKannan
    Feb 26, 2014 at 5:39
  • PTS by itself means "PIN transaction security", but when you are referring to the "devices", then they are usually called point of interaction, I believe that if you are comparing HSM and PTS I believe you are referring to PTS devices, and the point of sales you see in the picture is a good example of a PTS-dev.
    – kiBytes
    Feb 26, 2014 at 6:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .