Encryption is the conversion of readable data into ciphertext using an algorithm and a key, so that only someone holding the correct key can turn it back into the original. Symmetric encryption, such as AES, uses one secret key and handles bulk data; asymmetric encryption, such as RSA, uses a public and private key pair and is slower, so protocols like TLS use it only to agree on session keys. In payments it protects PINs at the terminal, card data in transit and stored card numbers, and PCI DSS requires it for stored and transmitted account data. Unlike tokenization or hashing, it is reversible, so key custody and rotation are what buyers review.
What is encryption: symmetric and asymmetric
Symmetric encryption uses the same secret key to encrypt and decrypt. It is fast, which is why it handles bulk data; AES with 128- or 256-bit keys is the modern default, while Triple DES survives in older PIN and card processing infrastructure and is being phased out. Asymmetric encryption uses a key pair: a public key anyone can use to encrypt and a private key only the owner can use to decrypt. RSA and elliptic-curve cryptography are the common families. Because asymmetric operations are slow, protocols such as TLS use them only to agree on a symmetric session key and then switch to AES.
How does payment encryption work
A card payment passes through several encryption layers at once:
- At the terminal, the PIN is encrypted inside the PIN pad, commonly using DUKPT, a scheme that derives a new key for every transaction so one stolen key exposes only one PIN.
- With point-to-point encryption, card data is encrypted at the moment of reading and decrypted only in the processor's secure environment.
- Between servers, TLS protects API calls. Online, the checkout page is served over HTTPS so card data typed into it is encrypted in transit.
- At rest, stored card data and backups are encrypted, with keys held separately from the data.
The keys are the real asset. They are generated and stored in a hardware security module and rotated according to documented key management procedures.
Encryption in payment security rules
PCI DSS requirement 3 covers protecting stored account data, including rendering the PAN unreadable wherever it is stored, and requirement 4 covers strong cryptography for cardholder data sent over open networks. SSL and early TLS have been prohibited for this purpose since mid-2018, so TLS 1.2 or later is the working floor. Under the GDPR, encrypting personal data can remove the obligation to notify individuals after a breach, provided the keys were not compromised with it.
Encryption vs tokenization and hashing
Encryption is reversible by design: anyone with the key recovers the data. Tokenization replaces the value with a surrogate that has no mathematical relationship to it, so there is no key to steal. Hashing is one-way and used to check a value without storing it. Many payment systems combine all three.
Encryption in a due diligence review
A buyer's technical review asks where decryption happens, who holds the keys, when they were last rotated and whether any legacy Triple DES keys remain in production. Weak answers usually translate into remediation costs after closing.