PCI PIN Security v3.1

Normative Annex A – Symmetric Key Distribution using Asymmetric Techniques 

 A2 – Certification and Registration Authority Operations 

Control Objective 6: Keys are administered in a secure manner 

Requirement 25: Access to secret or private cryptographic keys and key material must be: 
a) Limited to a need-to-know basis so that the fewest number of key custodians are necessary to enable their effective use, and 
b) Protected such that no other person (not similarly entrusted with that component) can observe or otherwise obtain the component. 

PIN Security Requirements:
25-7 CA application logs must use a digital signature or a symmetric MAC (based on one of the methods stated in ISO 16609 – Banking – Requirements for message authentication using symmetric techniques) mechanism for detection of alteration. The signing/MACing key(s) used for this must be protected using a secure cryptographic device in accordance with the key-management requirements stipulated in this document.
Testing Procedures:
25-7.a Examine log security controls to verify that CA application logs use a digital signature or a symmetric MAC (based on one of the methods stated in ISO 16609 – Banking – Requirements for message authentication using symmetric techniques) mechanism for detection of alteration.
25-7.b Examine documentation, interview personnel, and observe to verify that signing/MACing key(s) used for this are protected using a secure cryptographic device in accordance with the key-management requirements stipulated in this document.