3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times: ............ As at least two full-length key components or key shares, in accordance with an industry accepted method

I got some knowledges on NIST SP800-57 about the split-knowledge:"When split-knowledge procedures are used, the key shall exist outside of a [FIPS140] cryptographic module as multiple key components. The keying material may be created within a cryptographic module and then split into components for export from the module, or may be created as separate components. Each key component shall provide no knowledge of the key value (e.g., each key component must appear to be generated randomly). If knowledge of k components is required to construct the original key, then knowledge of any k-1 key components shall provide no information about the original key other than, possibly, its length."

I just got job as QSA for PCI field, I'm wondering AS a QSA how to Verify if the audited party meet the condition? Thanks a lot~


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.