FAQ #1253 Diff

Yes. Using strong cryptography to hash the password meets the intent of the PCI DSS Requirement 8.2.1,8.3.2, which requires that all authentication factors be rendered unreadable during transmission and storage using strong cryptography.

This requirement is designed to prevent unintentionalunauthorized disclosureaccess ofto these authentication factors, both in storage and as they traverse the network. When implemented properly, hashing ensures that passwords duringcannot transmissionbe overeasily recovered or misused, even if the networkdata oris during storage.compromised.

Please refer to the PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms for additional information on hashing.

(Note: PCI DSS Requirement numbers refer to PCI DSS version 3)