Frequently Asked Questions
Why does PA-DSS v3 require passwords to be protected by a one-way hash (Requirement 3.3.2), whereas PANs can be stored in an encrypted form (Requirement 2.3)?
FAQ Response
An application never needs to access plain-text passwords. When a user creates a password for the first time, the application generates and stores a hash of the password. When the user next provides their password to authenticate their access, the application will hash the supplied password and compare it with the previously stored hash of the user’s password: the application will never need to retrieve the plain-text password as it can authenticate access by comparing two hashes, rather than two plain-text passwords.
However, where a payment application needs to store PANs which it subsequently needs to be able to access, the PANs can not be stored using a hash, because the payment application would not be able to retrieve the plain-text PAN from the hash. Therefore PA DSS allows PANs to be stored in an encrypted format but also requires appropriate key management (Requirement 2.4). However if a payment application only needed to store a record of a PAN as a reference, but never needed to use the plain-text PAN again, it would be more secure for the payment application to store a hash of a PAN.
May 2015
Article Number 1287