We are using an IDTECH card reader for iPhone that is not encrypted, our application is web based and runs inside of an iOS app to pull the data off the card. We are then using a client side encryption library to encrypt the card data before it goes to the gateway. We do not store the card data in our database and our servers are PCI DSS Compliant. We want to use the non-encrypted MSR so we can scan driver license as well. Will this method comply with PCI 3.0?
Add a comment
|
1 Answer
In a nutshell, no.
Basically, any physical input device that "receives" clear card data (for example, by data entry - typing, swiping or other methods) must appear on the PCI "PTS" certification list.
In theory (and very concisely), this certifies that the device uses approved forms of encryption, key management,etc., only outputs safely encypted data, and is tamper-proof (to the point that any tampering destroys the crypto keys.)
Basically, the use of an uncertified device for input negates everything. It theoretically could be possible to obtain a "compensating control" around that, but as a practical matter, that is NOT going to happen. You are best just getting an approved device as your input device (for example, Magtech has a line of devices that work with IOS devices.)
Search the PCI PTS list as a starting point, or reach out to your financial institution for guidance.)
