Ciphertext
What is Ciphertext?
The result of encryption performed on plaintext using an algorithm (cipher) and a key. Ciphertext is designed to be unintelligible without the corresponding decryption key.
Frameworks that govern ciphertext
What the standards actually require on ciphertext
Requirements naming ciphertext across 4 standards, quoted from the control text.
The ability to access technical data or technology in encrypted form that satisfies the carve-out is not a release or export (120.54(c); 734.18(c)).
us-itar-and-ear-export-control-and-data-security::ITAR 120.54(c) and EAR 734.18(c) · Allow access to ciphertext by service providers only where the encryption carve-out is met →Cryptographic Erase (CE) sanitizes media by deleting or replacing the media encryption key used by self-encrypting drives, rendering ciphertext unrecoverable. Requires that all target data was encrypted before storage and the key destruction is verified.
MS-PURGE-5 · Cryptographic Erase →Key-management policies and procedures must be in place to change each key when its cryptoperiod ends, as set by the relevant application vendor or key owner and informed by industry best practice and guidelines, including: (1) a defined cryptoperiod for every...
3.7.4 · 3.7.4 Key changes at end of cryptoperiod →Keys are replaced once their crypto-period expires; the application vendor or key owner defines that period from industry practice such as NIST SP 800-57, either by elapsed time or by the amount of ciphertext produced.
pci-p2pe::5A-1.2 · PCI P2PE 5A-1.2 →Questions people ask about ciphertext
What is Ciphertext?
Why is Ciphertext important for compliance?
Which compliance frameworks address Ciphertext?
Where can I learn more about Ciphertext?
See how Ciphertext applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.