What does Requirement 3.6.1 specifically require?

What does Requirement 3.6.1 specifically require?

• A. Reuse of old keys is permitted.
• B. Generation of strong cryptographic keys.
• C. Public keys must be distributed publicly.
• D. No requirement for key generation.

Answer: (B)

The main idea here is how cryptographic keys used to protect cardholder data are created. Requirement 3.6.1 focuses on generating keys in a secure, controlled way, using strong algorithms and sufficient key length so they resist guessing or brute-force attacks. That’s why the correct choice is about generating strong cryptographic keys—the heart of protecting encryption keys in PCI DSS. Reusing old keys weakens security, and the standard does not require publicly distributing keys or claim there’s no need to generate keys.

The main idea here is how cryptographic keys used to protect cardholder data are created. Requirement 3.6.1 focuses on generating keys in a secure, controlled way, using strong algorithms and sufficient key length so they resist guessing or brute-force attacks. That’s why the correct choice is about generating strong cryptographic keys—the heart of protecting encryption keys in PCI DSS. Reusing old keys weakens security, and the standard does not require publicly distributing keys or claim there’s no need to generate keys.