Definition: Point-to-point encryption (P2PE) is an encryption standard established by the PCI Security Standards Council which protects cardholder data when a payment is made.
Point-to-point encryption explained
Point to point encryption encrypts payment card data from the point of capture, such as when the card is read by a card payment terminal, until it reaches the secure decryption endpoint Once received, the payment processor decrypts the data and either approves or declines the transaction. Encryption is the process of converting the payment card data into an unintelligible form.
The objective of P2PE and end-to-end encryption (E2EE) is to provide a payment security solution that encrypts confidential payment card data and information into indecipherable code when the card is used, preventing hacking and fraud. Even if a hacker were to intercept a particular transaction, the information obtained would be indecipherable since it would still be in its encrypted form. In order to decrypt the information, the user must possess the encryption keys, which are only made available to authorized parties.
In an increasingly complex regulatory environment, P2PE is intended to maximize the security of payment card transactions.
In order to achieve P2PE compliance, organizations must demonstrate that all transaction information is fully encrypted, that any hardware involved in the offering is securely managed, and that any cryptographic keys used in the process are generated, transmitted, and stored securely. Protecting keys within HSMs provides optimal security.
