In terms of PCI requirements and compliance, is a software-based key management module like Gazzang zTrustee an acceptable solution to the PCI requirements that a (hardware) HSM solution like AWS CloudHSM solves?


Something like a Gazzang zTrustee could be used to meet the PCI key management requirements. The trick would be to make sure that they help you follow all the requirements for PCI compliance. A good way to do this is to see if they are FIPS 140-2 certified, or at least follow the FIPS 140-2 standard published by NIST. A short review of the their site I don't think they are certified by they do mention that they follow FIPS requirements. It would take some more digging and asking questions to see what they actually mean by that.

As a more general answer to your question, PCI doesn't dictate that you have to use a hardware device for key management. You can use a either or a combination, anything that helps you meet the outlined requirements in section 3 of the PCI DSS.


The previous respondent has done a good job of answering your question. However, here is some additional insight.

a) Gazzang is no longer going to be selling or supporting their zTrustee solution starting next year 2015 (the support ends in June or July). So all Gazzang customers are looking for other solutions.

b) You should also take a look at PCI DSS 3.0 requirements since it appears that you are just starting to look into this issue.

c) As the other guy has mentioned, you don't need to use a FIPS compliant solution in order to comply with the PCI DSS mandates.

d) You might want to look at this solution. Interesting people behind this company (the guy who actually wrote the file system framework that is used by eCryptfs).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.