PCIDSS: Is hashing really safe?
Dec 29th, 2007 by Jesper Kråkhede
One of the requirements states that if you hash the PAN it is regarded as destroyed (safe). This was true before but with the rise of rainbowtables for breaking password hashes ordinary hashing could not be regarded as safe anymore. With ordinary I mean using a hash algorithm is unreversible and produces the same result everytime. This has formerly been regarded as the right way to go if you want to use PAN as data for your marketing but today it is very easy to produce rainvbow tables that makes the hash useless as an protection.
If you salt the hash you mitigates the problem of reversing the PAN:s but you loose the posibility to use hashed PAN:s for marketing unless you choose a something that is always the same for that specific PAN. I am not a cryptologist but I am sure there are some smart solutions on this. The most important part is that when the vendor says it is safe because the data is hashed be sure to ask what was used for a salt. No good answer = no good product.