The removal of Secure Sockets Layer (SSL)/ early Transport Layer Security (TLS) as examples of security protocols in the PCI Data Security Standard (PCI DSS) has prompted inquiries from payment application vendors on how this impacts Payment Application Data Security Standard (PA-DSS) validations. Here we’ll take a lookat a couple of these questions and an outline of important considerations when navigating SSL/early TLS migration and payment application validation.
Is it possible to have an application using TLS 1.1 that can meet the intent of ‘strong cryptography’ and be PA-DSS validated?
Whether an application using TLS v1.1 meets PA-DSS requirements for strong cryptography will depend on how TLS is configured, and the underlying cipher suites in use (the set of cryptographic algorithms used to establish a secure TLS session). For clarification on this point, the language in the Information Supplement: Migrating from SSL and Early TLS states:
“The best response is to disable SSL entirely and migrate to a more modern encryption protocol, which at the time of publication is a minimum of TLS v1.1, although entities are strongly encouraged to consider TLS v1.2. Note that not all implementations of TLS v1.1 are considered secure – refer to NIST SP 800-52 rev 1 for guidance on secure TLS configurations.”
Are the migration dates announced for SSL/early TLS for PCI DSS relevant for PA-DSS validations too?
The revised dates for migrating away from SSL/early TLS apply only to PCI DSS. From a PA-DSS perspective, the use of SSL/early TLS is not permitted as of PA-DSS version 3.1 (published in May, 2015). Applications currently validated to PA-DSS v3.0 must be revalidated annually by the application vendor to confirm that all methods of cryptography provided or used by the application meet PCI SSC’s current definition of strong cryptography. Vendors of applications that use SSL/early TLS will be unable to attest to this during revalidation, upon which the applications will be listed as “Acceptable Only for Pre-Existing Deployments.” Note that applications currently validated to PA-DSS v2 will expire on 28 October 2016, and will also be listed as “Acceptable Only for Pre-Existing Deployments” after that date.
Further guidance on the use of applications listed as “Acceptable only for Pre-existing Deployments” can be found here.
Want to read more on SSL/TLS migration as it relates to PCI DSS? Within the PCI SSC Document Library, there are several in-depth background materials regarding the migration from SSL and early TLS that are relevant to this discussion. Start by downloading recent Bulletin on Migrating from SSL and Early TLS to help you take advantage of available guidance and resources.
