The National Institute of Standards and Technology (NIST) has identified the Secure Socket Layers (SSL) v3.0 protocol (a cryptographic protocol designed to provide secure communications over a computer network) as no longer being acceptable for protection of data due to inherent weaknesses within the protocol.
Because of these weaknesses, no version of SSL meets PCI SSC’s definition of “strong cryptography.” Furthermore, with the recent release of issues with TLS, the only acceptable measures for secure communications is to use TLS 1.2 with the AEAD-Cipher Suite.
Revisions to the PCI Data Security Standard (PCI DSS) and the Payment Application Data Security Standard (PA-DSS) will be published. When published, PCI DSS v3.1 will be effective immediately, but impacted requirements will be future-dated to allow organizations time to implement the changes.
For PA-DSS v3.1, the Council is also looking at how to address both future submissions and currently listed applications. A summary of changes document for each standard and FAQs will accompany the release of the revised standards to help clarify the impact of these changes.
This determination and vulnerability expands beyond PCI, as many industries utilize SSL/TLS for secure communications that transmit privacy data and that are used to access remote systems. Organizations are urged to work with their IT departments and/or partners to understand if they are using SSL and weak forms of TLS and determine available options for upgrading to a strong cryptographic protocol as soon as possible.
As of today, there is no known way to remediate vulnerabilities inherent in the SSL protocol. Guidance for securing TLS communications can be found in the published NIST Standard NIST-800-52 rev 1.
