security - How to properly do private key management -
Is there such a practical experience or a reference to a plan that implements an important management plan that Will follow?
Obviously there are some implementations around the number of companies compatible with some PCI DSS, but the details of them are difficult to get. When the personal data goes down to archive, then discussions on using which encryption algorithm generally stop. After this, a statement is given about the storage of the private key in general, but there is no discussion about the practical method to do it or the key changes from time to time or the key of the application etc. Offers.
Especially I'm interested in the requirements of section 3.5 and 3.6 of the PCI DSS standard.
3.5.2 Store the cryptographic key safely in some of the least possible places and forms.
3.6.a Verify the existence of key-management procedures for the key used for the encryption of cardholder data: Many industry standards for critical management are available from various resources including NIST, which That can be found on.
3.6.4 Confirm that major management processes are implemented so that at least annual changes are required.
I have suggested as a document of PCI DSS requirements, but in addition to recent notes, actual implementation plans or standards do not seem much in the way.
What I'm trying to do is not:
- Store the password + S has the hash for authentication in the same way,
- Select strong synchronous algorithm for data encryption,
- Avoid the need to store personal data in the first place.
- Avoid the need for critical management with other mechanisms: physical security, database security, dragons and wizards etc.
Everyone has valid concerns but there are no answers in this case. Nuts and bolts of my needs are in a different SO question but it boils down to all major management, so this is a more refined question.
I am aware of the pain through which you are going to go to PCI compliance with an old EFT The system has struggled to update. Key management was definitely the most challenging part (from my software point of view).
I think I also posted in Martin, and was incredibly disappointed because of the lack of concrete examples.
Perhaps most relevant to your needs with PCI-DSS. Although this is a good thing, this document is a large collection of TLA, which I know I definitely have to read.
When frustration becomes frustrating then I stumble into a fictional story, discussed technical references X9.17 and can help in understanding.
With this reference material I have prepared an important management system which was pleased with our auditors. The design documentation is quite long, but in short this idea is that you have a encrypting key that is protected by the key encrypting key, and the key encryption key is stored on a physically separate box , Which is protected by the master key.
My implementation was a major server application running on a windows box. Before this can be used, this app will need to have access to two different 'key server master keys'. These keys are known only to the major server administrators. These keys together to make the master key are xor'd Are stored in secure memory only, while the application is running. The application can automatically generate cryptographic strong key encryption keys, which are stored in an encrypted form using a master key.
Application keys requiring encryption will request the key to encrypt keys from the server. KEK is used to encrypt the app to encrypt / decrypt, which can be safely stored with application data.
Good luck, I hope you find an interesting challenge too!
Comments
Post a Comment