Skip to main content
Commerce Security Authority

PCI DSS v4.0 Requirement 3 reference

Which Algorithms Still Pass Under PCI DSS v4.0

The accept/prohibit baseline for AES, RSA, ECC and hashes, plus the 3DES sunset and the 112-bit bar.

Get the reference guide

The problem

You need a defensible baseline before you can justify a migration

When you run a cryptographic inventory, the hard part is not finding the algorithms, it is proving which ones PCI DSS v4.0 still accepts and which you are now obliged to retire. Encryption is only as strong as the key management around it, and Requirement 3 demands documented, auditable controls that most teams cannot readily evidence. Without a clear accept/prohibit line, every migration decision and timeline is an argument you have to win from scratch.

17-page practitioner reference

Get the reference guide

Encryption and Key Management Reference for Cardholder Data Environments - the accept/prohibit baseline for AES, RSA, ECC and hashes, mapped to PCI DSS v4.0 Requirement 3.
  • Written for practitioners, mapped to PCI DSS v4.0 clauses
  • Acceptable-algorithms table with minimum key lengths
  • AES mode guidance for payment contexts
Encryption & Key Management Reference

Download the guide

Written for practitioners, mapped to PCI DSS v4.0 clauses.

Verifying you're human...

Inside the reference

What is inside the reference

The acceptable-algorithms table: AES, 3DES, RSA, ECC, SHA-2/SHA-3 and MD5/SHA-1 with minimum key lengths and PCI DSS status
AES mode guidance for payment contexts - CBC, GCM, ECB and CTR, and where each is acceptable
Symmetric vs asymmetric use cases: PAN encryption at rest, key wrapping, TLS, and audit-log signatures
A weak/deprecated-to-compliant replacement mapping for DES, 3DES, RSA-1024, MD5, SHA-1 and RC4
The strong-cryptography definition and the 112-bit effective-strength bar that sets the whole baseline

The payoff

What you can do once you have it

Justify your migration timeline

Prioritise any algorithm protecting live cardholder data or key material against a clear accept/prohibit line instead of guesswork.

Defend each choice to your QSA

Every recommendation ties back to a specific Requirement 3 sub-requirement - 3.5, 3.6 and 3.7 - so your rationale is documented, not asserted.

Fix the findings before an assessor does

Work the three most common assessment findings with concrete remediation checklists rather than discovering them mid-audit.

Set vendor and platform requirements

Turn the baseline into evaluation criteria for HSMs and key management platforms, from FIPS validation levels to platform-enforced dual control.

Standards, not opinion

Grounded in the standards, not opinion

Mapped to Requirement 3

Cites PCI DSS v4.0 Requirements 3.5.1, 3.6.1, 3.7.1, 3.7.2, 3.7.6 and 4.2.1 throughout.

Anchored to primary sources

References NIST SP 800-90A (DRBG), NIST SP 800-186 (curves), ANSI X9.24, PKCS#11, RFC 3394 and TR-39.

FIPS validation levels

Specifies FIPS 140-2/140-3 validation levels required for HSM-based key storage.

Working reference tables

Includes algorithm and key-length tables, crypto-period tables, and a controls-to-scope matrix.

FAQ

Questions engineers ask before downloading

The guide sets out the 3DES/TDEA position - sunset after 2023 in new implementations - alongside its 112-bit effective key length, so you can tell where existing use stands versus new deployments.

PCI DSS v4.0 Requirement 3 reference

Get the accept/prohibit baseline for your migration

The 17-page reference guide - AES, RSA, ECC and hashes, the 3DES sunset and the 112-bit bar. Written for practitioners, mapped to PCI DSS v4.0 clauses.