Payment Card Industry (PCI) Data Security Standards Practice Test

What do PCI DSS requirements for protecting cryptographic keys include?

1. Public keys must be encrypted with a key-encrypting key

2. Data-encrypting keys must be stronger than the key-encrypting key that protects it

3. Private or secret keys must be encrypted, stored within an SCD, or stored as key components

4. Key-encrypting keys and data-encrypting keys must be assigned to the same key custodian

The correct answer is: Data-encrypting keys must be stronger than the key-encrypting key that protects it

The requirement that data-encrypting keys must be stronger than the key-encrypting key that protects it aligns with the PCI DSS principle of maintaining robust security measures for sensitive data. This is essential because if a key-encrypting key provides inadequate protection, it may compromise the security of the data-encrypting keys it secures. Stronger data-encrypting keys ensure that even if the key-encrypting key is compromised, the data remains protected due to the strength of the encryption applied to it. This requirement emphasizes the importance of using appropriate key management practices to safeguard cryptographic assets, ensuring a layered defense against potential breaches. In this way, it contributes to maintaining the confidentiality and integrity of cardholder data, which is a fundamental goal of PCI DSS compliance. The structure of cryptographic keys must be designed carefully to ensure that they effectively guard against unauthorized access and potential theft of sensitive information.