Point-to-point encryption provides an additional layer of protection for cardholder data beyond SSL. There is debate around the best encryption algorithm to use, with options including triple-DES, PGP, and symmetric or asymmetric keys. Proper implementation of encryption and decryption logic is important, with decryption occurring either through software or hardware security modules that prevent exposure of encryption keys. Encryption can happen at different points like card entry, within payment terminals, or outside via libraries. While security is a key driver, point-to-point encryption also allows some merchants to avoid PCI compliance requirements.

1. Point-to-point Encryption
Point-to-point encryption technology evolved in response to emergence of new types of credit card fraud.
Although SSL protection is always there, at communication level, point-to-point encryption provides
additional protection layer for cardholder data.
There is no unified opinion as to which algorithm is the best one when it comes to point-to-point encryption.
Some businesses use symmetric encryption keys and encrypt the data with triple-DES algorithm, while
others choose asymmetric keys and such encryptiondecryption algorithms as PGP.
Implementation of encryption logic and implementation decryption logic are the key issues to consider when
it comes to some particular point-to-point encryption solution.
Decryption can be performed either at hardware or at software level (http://unipaygateway.com/en/).
Hardware security modules (HSM) are often used for decryption. The advantage of HSM-based approach is
that the encryption key never gets exposed, as it resides within a special hardware device.
Encryption can be performed at the point of card entry (or point of swipe), within a payment terminal, or
outside the terminal (by a DLL library).
Although security considerations provide the key reason for point-to-point encryption implementation, some
merchants implement the approach, because it allows them to stay (or get) out of PCI scope. Often point-to-
point encryption and tokenization (http://paymentterms.org/glossary/tokenization/) are used “side-by-side”.
More detailed information on point-to-point encryption (http://paylosophy.com/point-point-encryption/) is
available on #Paylosophy.
.