Control Objective 2: Cryptographic keys used for PIN encryption and decryption and related key management are created using processes that ensure it is not possible to predict any key or determine that certain keys are more probable than others – PCI PIN Security
PCI PIN Security 6-6: PCI PIN 6-6
What does 6-6 require?
Policy and procedures prevent clear-text private or secret keys, components or shares from crossing insecure channels: no dictation, voicemail, fax, e-mail or other electronic conveyance, no conveyance outside tamper-evident authenticable packaging, and no writing of values into startup instructions, onto or inside devices, or into procedure manuals.
Other controls in Control Objective 2: Cryptographic keys used for PIN encryption and decryption and related key management are created using processes that ensure it is not possible to predict any key or determine that certain keys are more probable than others – PCI PIN Security