We have a business requirement to keep credit card data. What is today's (Nov 2013) state of the art algorithm to encrypt credit card data that will be saved on disk? Additionally, I'd appreciate pointers to Java libraries that implement these algorithms

Note that we are PCI compliant and we already store credit card data. I am doing a review to make sure that our encryption method remains state-of-the-art

  • $\begingroup$ For actual security in a situation like this the implementation is the most important thing. Using AES128_CTR is just fine, but implementation and key management is where problems occur. Exposure of both data and key will expose everything, it is best to use a hardware security module to store the key and perform encryption. $\endgroup$ Commented Nov 14, 2013 at 19:23
  • 2
    $\begingroup$ Realistically, state of the art is to use an HSM. $\endgroup$ Commented Nov 14, 2013 at 23:48

2 Answers 2


In practical cryptography, you do not use state-of-the-art, the newest and shiniest algorithms, but instead something required or recommended by the appropriate standards.

In PCI, AES, Triple-DES, SHA-1, RSA etc. are fairly common. PCI is bit slow to adopt new cryptographic standards. This is for part that payment industry uses devices (like cards) with relatively underpowered processing units.

If you want something that is state-of-the-art, and practical, you may enjoy e.g. cr.yp.to, but those algorithms are likely not accepted by some of the PCI standards.

For encrypting credit card data stored on disc, one modern fancy combination would be AES-256 with FPE.

  • $\begingroup$ Thank you for the suggestions. I should clarify that our application is for "data at rest": we do both encryption and decryption. This means we have freedom to select the algorithm. However we would like to use off-the-shelf crypto libraries - whether commercial or open-source. $\endgroup$
    – Bernard
    Commented Nov 15, 2013 at 0:58

The banking and financial communities, in particular, are very conservative. For example, 3DES has long been the standard for PIN encryption, and replaced DES when DES became too long in the tooth. It may be slower than AES, but is venerable and trusted.

IBM z-series mainframes have long supported hardware encryption. Their latest in processor assisting hardware is the PCIe Crypto Coprocessor (PCIeCC), which accelerates DES, AES, modular math functions used in RSA, SHA-1, SHA-256, ECC, ECDSA, MAC, HMAC, random number generation, and key storage. It's all packaged in a tamper resistant card. Because so many banks continue to use big IBM hardware, and IBM offers top-notch cryptographic consulting services, those are the routines you're likely to encounter in other companies.

Keep in mind that while the cryptography is important, it's key management that is of paramount importance, especially to PCI auditors. A well-qualified QSA should expect you to produce a fully documented key management process, including things like the key lifecycle events and states (generated, active, retired, compromised, destroyed, etc.), roles and responsibilities (owners, custodians, etc.), cryptoperiods, certificates, etc.

And if your QSA doesn't require this info, ask yourself what other security failings is he allowing to slip by unnoticed?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.