My employer was recently notified that it needed to upgrade it's legacy system to be 'PCI' [in the credit card data protection/privacy sense] compliant.

For example see the Visa's pdf at [link|http://usa.visa.com/download/business/accepting_visa/support_center/cisp_overview.pdf#search=%22visa%20pci%22|http://usa.visa.com/...=%22visa%20pci%22]

Most of the requirements are fairly straightforward [Convert database columns from plain text to [probably] Triple DES encrypted values.

But there are a few open issues,

• How to protect and securely distribute the encryption keys?



• How to recover the key that matches a particular database backup?

There are several vendors who will sell you a 'magic box' that acts as a key management system. These boxes seem to require other hardware, software and consulting services from the vendor [and have unknown reliability issues].

There is also a 'Symkey' LGPL project on SourceForge [link|http://www.strongkey.org/|http://www.strongkey.org/] - but it is clearly not ready for prime [or any other] time yet.

Has anyone had experiance implementing a key management system?

Somehow this ended up over in 'M$ is Guilty', it should be in 'Security'.

I'll reply over there [and try editing this post to link to the new message]