As per the PCI-DSS 3.5.2 requirement

Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data encrypting key.

Does this mean:

  1. Storing the keys(DEK and KEK) in different servers(server1 and server2) or
  2. Storing the keys(DEK and KEK) in different location path on the same machine.

path1(DEK): c:\user\chandru\Document\DEK\DEK.txt

path2(KEK): c:\user\chandru\Document\KEK\KEK.txt

or 3. Storing the keys(DEK and KEK) in different user location on the same machine.

path1(DEK): c:\user\chandru\Document\DEK\DEK.txt path2(KEK):c:\user\somenewuser\Document\KEK\KEK.txt

Is there any other way to store the key apart from the HSM as per the PCI-DSS standards?

Dedicated Server with HSM:

enter image description here

Two dedicated server without HSM:

enter image description here

  • I have edited your question to remove the overly localised requirement. Decisions around exactly what method you should use for your specific environment and needs require much more information and are not appropriate here.
    – Rory Alsop
    Feb 28, 2014 at 9:40

2 Answers 2


There's two ways to do this:

Simple storage-only approach

The first method is to use one device for encrypting the data, and another device for storing it. So data gets encrypted on some application server, but gets stored on a database server. The place where the data is stored does not posses any of the keys, it's just storage.

More complex but more secure approach

The second method is to use a public/private keypair. A unique, random session key is generated for every piece you want to encrypt. You encrypt the sensitive data with the session key, and the session key with your public key, and then discard your session key.

You can then store the encrypted block on the same server as the public key that was used to encrypt it, since the public key is useless for decryption.

To decrypt your data, you use the private key to decrypt your session key, and use the session key to use decrypt the sensitive data.

This is how tools like PGP/GPG work, so you don't need to (and shouldn't) implement it yourself, you can just use one of these stock utilities.

  • @tylerl.Thanks, According to your suggestion if I choose the "Simple storage-only approach", then does my design will be "Two dedicated server without HSM" which is shown in the above figure of my question? Feb 28, 2014 at 11:48
  • @chandru Bear in mind that if an attacker gets control over the application server and can, from there, easily access your storage server, then you're not really solving the problem. There should be access control such that a compromise of the application server doesn't implicitly negate the effect of separation.
    – tylerl
    Feb 28, 2014 at 17:36
  • Ya I'm totally agree with you, so instead of using the key server I'm using the HSM. HSM is connected to my application server in this scenario as anyone got access to the app server, can get the DEK from HSM, isn't it? so how HSM is secure then? Mar 3, 2014 at 10:27

So you have 2 questions

What does stored separately in the 3.5.2 requirement mean?

"Separate" means, well, separate, so as far as that particular requirement is concerned, your 1rd, 2nd, 3rd methods are all fine. However in other requirements (e.g. read all of Requirements 3.5 & 3.6) PCI-DSS wants you to make sure your key storage is secure, so you don't just need to separate the KEK from the DEK, you must store the KEKs securely (e.g. in a HSM, or a software based key store)

Is there any other way to store the key apart from the HSM as per the PCI-DSS standards?

Of course yes, the PCI-DSS standard doesn't require you to use a HSM for key storage. As long as your key (the KEKs) storage is secure, you're fine. In our projects we use exactly your "Two dedicated server without HSM" approach. Be noted that your "Key Server" should actually provide both key storage function and encryption/decryption function (thus should be called something else). That way, your KEKs (your most "precious" keys) are never exposed to the client code (applications running on Application Server in our diagram).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .