PIN Security Requirements:
5-1 Keys must be generated so that it is not feasible to determine that certain keys are more probable than other keys from the set of all possible keys. Generation of cryptographic keys or key components must occur within an SCD. They must be generated by one of the following:
- An approved key-generation function of a PCI-approved HSM or POI
- An approved key-generation function of a FIPS 140-2 or FIPS 140-3 Level 3 (or higher) HSM
- An SCD that has an approved random number generator that has been certified by an independent laboratory to comply with NIST SP 800-22
Note: Random number generation is critical to the security and integrity of all cryptographic systems. All cryptographic key-generation relies upon good quality, randomly generated values.
Testing Procedures:
5-1.a Examine key-management policy documentation to verify that it requires that all devices used to generate cryptographic keys meet one of the following
- An approved key-generation function of a PCI-approved HSM or POI
- An approved key-generation function of a FIPS 140-2 or FIPS 140-3 Level 3 (or higher) HSM
- An SCD that has an approved random number generator that has been certified by an independent qualified laboratory according to NIST SP 800-22
5-1.b Examine certification letters or technical documentation to verify that all devices used to generate cryptographic keys or key components meet one of the following
- An approved key-generation function of a PCI–approved HSM or POI
- An approved key-generation function of a FIPS 140-2 or FIPS 140-3 Level 3 (or higher) HSM
- An SCD that has an approved random number generator that has been certified by an independent qualified laboratory according to NIST SP 800-22
5-1.c Examine procedures to be used for future generations and logs of past key generations to verify devices used for key generation are those as noted above, including validation of the firmware used.
