PCI - encryption requirements

Greetings, all,

A question has arisen and, like all the other posts here, I hope someone
might be able to assist me.  :>)

In the new PCI Data Security Standard for credit cards, the documentation
indicates a requirement for "strong encryption such as Triple-DES 128-Bit or
AES 256-bit", but no additional information seems to be provided.  My
explanations about strong encryption meaning strong algorithm (no
significant know weaknesses), long key length and appropriate key management
schemes are not going far.  I believe they want to see it in black and white
for themselves, as I have received a request to locate a definitive
"approved" list and/or a "not approved" list of algorithms for what
constitutes strong encryption - does anyone know of such a list published by
Visa or Mastercard??

Thanks in advance,

Laurin Buchanan, CISSP
Information Security 
MSC Industrial Direct
v: 516.812.1358




This e-mail is intended for the use of the addressee(s) only and may contain
privileged, confidential, or proprietary information that is exempt from
disclosure under law. If you are not the intended recipient, please do not
read, copy, use or disclose the contents of this communication to others.
Please notify the sender that you have received this e-mail in error by
replying to the e-mail. Please then delete the e-mail and destroy any copies
of it. Thank you.