Implementation of Point-to-point Encryption

Written by

James Davis

Written by James Davis

Senior Technical Writer at United Thinkers

Author of the Paylosophy blog, a veteran writer, and a stock analyst with extensive knowledge and experience in the financial services industry that allows me to cover the latest payment industry news, developments, and insights. Read more

Reviewed by

Kathrine Pensatori

Reviewed by Kathrine Pensatori

Product Specialist at United Thinkers

Product specialist with more than 10 years of experience in the Payment Processing Industry. I help payment facilitators and PSPs solve their various payment processing issues. Read more

Point-to-point encryption technology evolved in response to emergence of new types of credit card fraud. Although SSL protection is always there, at communication level, point-to-point encryption provides additional protection layer for cardholder data.

There is no unified opinion as to which algorithm is the best one when it comes to point-to-point encryption. Some businesses use symmetric encryption keys and encrypt the data with triple-DES algorithm, while others choose asymmetric keys and such encryptiondecryption algorithms as PGP.

Implementation of Logic

Implementation of encryption logic and implementation decryption logic are the key issues to consider when it comes to some particular point-to-point encryption solution.

Decryption can be performed either at hardware or at software level. Hardware security modules (HSM) are often used for decryption. The advantage of HSM-based approach is that the encryption key never gets exposed, as it resides within a special hardware device.

Encryption can be performed at the point of card entry (or point of swipe), within a payment terminal, or outside the terminal (by a DLL library).

 Although security considerations provide the key reason for point-to-point encryption implementation, some merchants implement the approach, because it allows them to stay (or get) out of PCI scope. Often point-to-point encryption and tokenization are used “side-by-side”.

 More detailed information on point-to-point encryption is available on #Paylosophy.