Encryption

Encryption is the process of transforming data into an unreadable format, ciphertext, using a cryptographic algorithm and a secret key, such that the original data can only be recovered by someone with the appropriate decryption key. In payments, encryption is used to protect cardholder data during transmission (in-transit encryption) and when stored in databases or file systems (at-rest encryption).

PCI DSS requires the use of strong cryptography for protecting cardholder data in transit across open, public networks (Requirement 4) and for rendering stored Primary Account Numbers (PANs) unreadable when they must be retained (Requirement 3). The standard specifies the use of industry-tested cryptographic protocols, TLS 1.2 or higher for data in transit, and AES-256 or equivalent for data at rest, and prohibits the use of outdated or weak protocols like SSL and early versions of TLS.

Encryption is a foundational security control but it is not a substitute for Tokenization in payment environments. Encrypted PANs remain in-scope cardholder data under PCI DSS because they can be decrypted. If the encryption key is compromised, all encrypted data is exposed. Tokenization, by contrast, replaces the PAN with a random reference value that has no relationship to the original data, the token is not sensitive and is not subject to the same PCI requirements as the PAN it replaced. For this reason, most modern payment security architectures use tokenization to minimize scope and encryption as a defense-in-depth measure for the data that must be retained within the scope boundary.

Frequently Asked Questions

What is the difference between in-transit and at-rest encryption in payments?

In-transit encryption protects data as it moves between systems, for example, the TLS encryption applied to card data transmitted from a customer's browser to a payment gateway, or between a merchant's server and a payment processor's API. At-rest encryption protects data stored in databases, file systems, or backup media, for example, encrypting a database table containing card numbers so that a database backup or an attacker with database access cannot read the raw card data.

What is TLS and why is it required for payment data transmission?

TLS (Transport Layer Security) is the cryptographic protocol that establishes encrypted connections between systems communicating over a network. When a customer enters card details in a browser, TLS encrypts that data before it leaves the browser, ensuring it cannot be read in transit. PCI DSS requires TLS 1.2 or higher for all transmission of cardholder data over open networks; TLS 1.0 and 1.1 are explicitly prohibited as they contain known security vulnerabilities.

Does PCI DSS v4.0.1 introduce any new encryption requirements?

PCI DSS v4.0.1 tightened several cryptography requirements that became mandatory on March 31, 2025. Disk or partition-level encryption alone is no longer an acceptable method for rendering stored PANs unreadable, it must be combined with another mechanism such as hashing, tokenization, or index tokens. Cryptographic hashes used to render PANs unreadable must be "keyed cryptographic hashes" (hashes with a secret key, to prevent brute-force attacks).

Encryption

Frequently Asked Questions

What is the difference between in-transit and at-rest encryption in payments?

What is TLS and why is it required for payment data transmission?

Does PCI DSS v4.0.1 introduce any new encryption requirements?

Related Terms

Insights and updates you actually care about