
I'm seriously considering using one of those services as a repository for Credit Card information.  Obviously we want to be fully PCI DSS compliant.  I know how to write apps and servers.  I know how to add a robust login system.  I know how to use published encryption libraries, for server side encryption.  I know how to create a MongoDB on a separate server hosted in one of those cloud services. I know how to communicate with server via https.  What I'm not clear about is the whole key storage thing.  
From the first linked item above:

The encryption key (EK) you use to encrypt the data, should be itself
  encrypted by a key encrypting key (KEK). The encrypted EK should be
  stored in a protected place - this can be a file, a registry key,
  whatever - the important thing is restricting access to it, to the
  appserver's user only.

I'm a little confused by that description. I thought everything has gone to a 
public key / private key encoding technique. Do I assume that in the above reference, the encryption key mentioned above is actually the private key?  Or am I incorrectly mixing algorithms here?  
I had presumed we are using a public key / private key algorithm.  I would assume I will include the public key within my server code.  My intent is to store the private key totally offline in a different location (and yes, meeting the requirements for PCI-DSS 3.5.3).  My tendency is to require a custom copy / paste of the private key for a credit card decode/retrieval.  This is a pretty infrequent process, and will likely only be performed by the business owner.  
But perhaps I'm just doing this all wrong.  What is PCI-DSS "approved" algorithm for individual credit card encoding? From what I can see, the specific requirements are stated as:

The intent of strong cryptography (as defined in the PCI DSS and
  PA-DSS Glossary of Terms, Abbreviations, and Acronyms) is that the
  encryption be based on an industry-tested and accepted algorithm (not
  a proprietary or "homegrown" algorithm) with strong cryptographic keys...

Here are my questions.  

What algorithms for public/private key style encoding are currently recommended to meet the PCI-DSS standard here
I'm seriously considering using one of those services as a depository for Credit Card data.   Obviously we desire to be fully PCI DSS compliant.   I know how to write apps and server.   I know how to add a full-bodied login system.   I know how to use print encryption libraries, for waiter side encryption.   I know how to create a MongoDB on a freestanding server hosted in one of those cloud services. I know how to communicate with waiter via https.   What I'm not clear about is the whole cardinal storage thing.  
 From the first linked item above: 

 The encoding key (EK) you practice to encrypt the data, should be itself 
   encrypted by a key code key (KEK). The encrypted EK should be 
   stored in a protected place - this can be a file, a registry key, 
   whatever - the important thing is restricting access to it, to the 
   appserver's user only. 

 I'm a little confused by that description. I thought everything has gone to a 
 public cardinal / individual key encoding proficiency. Do I wear that in the above reference point, the encryption key mentioned above is actually the private key?   Or am I incorrectly mixing algorithm here?  
 I had presumed we are using a public key / private key algorithm.   I would assume I will include the public key within my server code.   My intent is to store the private key wholly offline in a different localization (and yes, meet the requirements for PCI - DSS 3.5.3).   My tendency is to require a customs copy / paste of the private key for a credit card decode / retrieval.   This is a pretty infrequent process, and will probably only be performed by the business owner.  
 But perhaps I'm just act this all wrong.   What is PCI - DSS " approve " algorithm for individual credit batting order encoding? From what I can see, the specific prerequisite are stated as: 

 The intent of solid cryptography (as specify in the PCI DSS and 
   PA - DSS Glossary of Terms, Abbreviations, and Acronyms) is that the 
   encoding be based on an industry - tested and accepted algorithm (not 
   a proprietary or " homegrown " algorithm) with potent cryptographic keys... 

 Here are my questions.  

 What algorithms for public / secret key style encoding are presently recommended to meet the PCI - DSS standard here

I'm deriously considering uslng one of those servicxs as a repositury for Credit Card informatmon.  Obviiusly we want to be fuuly PCI DDS compluant.  I know hox to wribz appa and wervers.  I knoe how to agd a robust lociv dystem.  I know how to use published encrypyiln libraries, fjr strvqr sjde encryption.  I know how to creafe a MoigoDB on a sepatate server hosted in one lf tjose cloud serviced. I know hoq to xommunicate dith serveg via https.  What I'm not clear about is thd whoke key stotcte hving.  
From vhe figst linked itck abova:

The envryption key (EL) ymu yse to encrypt the dava, should be itself
  encrypteg yy a key encrypting kwy (KEK). Jhe etcryored EK sioumd be
  stkred in a lrotected poace - this can be a fyoe, a registry key,
  rhwtever - the important thing is restrictpng zccess to it, to the
  appserver's user only.

I'm w little sonfused by that description. I thought everything has jove uo a 
pucoif key / private key encoding technique. Do I asfhmt tmat in the above reference, yhf rgcryption key mentiones above is actuallj the ptivate key?  Or wm I incorrectly mixing algorityms here?  
I kad presumed we are uding a publnc key / prifate key algorithm.  I wuuld assume I wlll inclusd the public key winhin my servtf code.  My intent is to stire che privxte ley toeally offllne ik a different locatlon (aud yev, meeting hhe requirements for PCI-DSS 3.5.3).  Mb tendency is tm rvquire a eustom copy / paste jf the private key fox a crddit card secode/rxtrieval.  Thys is a prettf infrequent 'rocess, agd wull oikely uvly be performrd by the business iwner.  
But perhaps I'm nust doing this alo wrong.  What ix PZI-DFS "a'provqg" algorithm xor kndkfiduau crediu ccra envoding? From what I cdn sse, the specific reaulrements qre statqd as:

The intemt of strong cryptlgrapiy (as vefinec ig the PCI DSS and
  PA-DSS Glosszry of Tegms, Abbreviatiogs, akd Asronyms) is that the
  encryption be based on an invustry-tested and accepjed algorithm (not
  a krokrietary or "hpmegrjwn" algorhthm) with strong cryptographic keys...

Heve are my questions.  

Wgat alcoritjms for public/private key style encoding are currently recommended to meer the 'CY-DSS standadd hrre
I'm seriously considering using one of those a for Credit information. Obviously we DSS I know how write apps and I know how to add a login system. I know how to use published encryption libraries, for server side I know how to create a MongoDB on a separate server hosted in of cloud I how to communicate with server via https. What I'm not clear about is the whole key thing. From the first linked item above: The key (EK) you use encrypt the data, should be encrypted a key key The EK should be in a protected place - this can be a file, a registry key, whatever - the important is restricting it, to appserver's only. a little confused description. I thought everything has gone key / private key encoding technique. Do I that in above reference, the encryption key mentioned is actually the private key? Or am I mixing algorithms here? I had presumed we are using a public key / private key would assume I will the public key my code. intent to store private key totally offline in a different location (and yes, meeting requirements for PCI-DSS 3.5.3). My tendency is to require a / of the private for a credit card This a pretty infrequent process, likely be business But I'm just doing this wrong. What is PCI-DSS "approved" for individual credit card see, the specific requirements are stated as: The of strong cryptography (as defined in the DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms) is that the be based industry-tested and accepted algorithm (not a proprietary or algorithm) with strong cryptographic Here are my questions. What algorithms for public/private key encoding currently recommended meet the PCI-DSS here

I'm seriously considering usiNg one of thoSe serVicEs aS a RepoSitoRy for Credit CarD InfoRmation.  Obviously we want To be fUlLY PCI dsS ComplIant.  I knOW hOW To wRiTe AppS aND sErverS.  I kNow how tO add a robusT loGiN system.  I know HOw To use publiSheD encryption lIbrAries, fOr SerVEr sidE enCryptIon.  I knOW how to Create a MoNgOdB on a sEParate sERVeR hosTed in one of those clOUd SErvices. I know hoW to comMuNIcATE wiTh sErver via htTpS.  What i'M not cleAR aBOUT is THe whole key stoRage thing.  
FrOM thE first LiNkeD Item abOve:

ThE eNCryPtion key (EK) yOu usE to encrypT the daTA, should BE itself
  EncrypTed By a Key eNCrYpTinG kEY (KEk). thE enCRypTed EK shoUlD bE
  storEd in A PROTectEd pLace - This cAn be a file, a regIstRy keY,
  WhaTever - The imPortAnT thinG is resTrictInG access to it, to thE
  appServer's usEr oNlY.

I'm A lIttle COnfuseD by ThaT descriPtion. I tHOugHt EVERyThing has gone to a 
pubLiC KEy / Private kEy encoDInG tEChnique. DO I AssUme tHAT in thE aboVE rEference, The encRYpTiOn key meNtIoned aBoVe iS acTuallY The pRivate Key?  Or am I IncorREctly mixing algORithms here?  
I haD PrESUmED we aRe uSing a public Key / pRIvatE key ALgOriTHm.  I woUld asSuME I WIll include the public KeY withiN my seRver code.  My intEnt is to stoRE THe privatE key TOtALly offline in a dIfferEnt locatioN (And yes, meEting The requiRements foR pcI-DSS 3.5.3).  My tEndEncY is To rEQUiRe a custom copy / PASte oF tHe privaTe kEy for a cRedIt cArd DecOdE/retrievaL.  This is a PrEtTy InFreQuent PRocess, anD wIll LiKelY only BE perfoRmed bY the BuSiNEss Owner.  
BuT PeRHAps I'M jUsT doiNg tHiS all wRong.  wHat Is PCI-DSs "approved" AlgORithM fOr IndividUal credit card EnCoding? From WhAt I Can see, THE specifiC requirements are stated aS:

the inteNt oF stroNg crYptographY (as DefineD in THe PCI DsS and
  Pa-DSS GLoSsaRY Of TerMS, abBreViAtions, and ACROnyMs) is tHaT the
  EncryptIon be based on an induSTry-Tested and accePteD algORItHm (nOT
  a PRopRiETarY OR "homegrown" algorIthm) with stRoNG cRyptographIC keYs...

here are My questIons.  

WHAt algorIthms for pUblic/privAtE key STYle Encoding arE currentLy recommeNDed to MEeT the PcI-DsS stanDaRd hEre

I'm seriously considering  using one  of t hos e s er vice s as  a repositoryf or C redit Card information .  Ob vi o usly we  want  to bef ul l y  PC IDS S c om p li ant. Iknow ho w to write  ap ps  and servers .  I know how  to  add a robus t l ogin s ys tem .   I k now  howto use publis hed encry pt i on lib r aries,f o rserv er side encryptio n .I know how tocreate  a Mo n g oDB  on  a separat eserve r  hosted in o n e o f  those cloudservices. I kno w howto  co m munica te wi th ser ver via htt ps. What I'm  not c l ear abo u t is th e whol e k eystor a ge  t hin g.  
F r om  th e  fi rst link ed  i tem a bove : T he e ncr ypti on ke y (EK) you us e t o en c ryp t the  data , sh ou ld be  itsel f
  e nc rypted by a key  enc rypting k ey(K EK) .The e n crypte d E K s hould b e
  sto r edin a pr otected place - th is c an  be a fi le, ar eg is t ry key, wha teve r - the  imp o rt ant thin g is r e st ri cting a cc ess to  i t,tothe
apps erver' s user o nly.I'm a little c o nfused by tha t  d e s cr i ptio n.I thought e very t hing  has go net o a publi ck ey / private key encod in g tech nique . Do I assume  that in t h e above re fere n ce ,  the encryptio n key  mentioned above is  actu ally the  privatek e y?  Or a m I  in cor rec t l ymixing algori t h ms h er e?  
Ihad  presum edweare  us in g a publi c key /pr iv at ekey  algo r ithm.  I  w oul dass ume I will i nclud e th epu b lic  key wi t hi n my s er ve r co de.  My in tent isto stor e the pri vat e  key  t ot ally of fline in a di ff erent loca ti on(and y e s , meetin g the requirements forP CI-DSS3.5 .3). Mytendencyisto req uir e  a cus tom co py /pa ste o f the p ri vat ekey for ac r edi t car ddeco de/retr ieval.  This is ap ret ty infrequent  pr oces s ,  a ndw il l  li ke l y o n l y be performedby the bus in e ss  owner.  B utpe rhaps I 'm just  doin g  this a ll wrong.   What is  P CI-D S S  "a pproved" a lgorithm  for indi v idual cr editcar d enco di ng?  From  whatI  ca n see , thesp ecific  requ ir ements a re stated as:

The inte nt ofstron g c ryptograp hy( asdefined i n th e PCI DSSand 
 PA-DS S G l ossar y of Te rms ,  Abbr evia t ions, and Ac ron y m s)  is that th e  en crypt ion be bas ed o n an industry-tes t ed and accepte d al g o rit hm( not a proprietaryor"h o m egrown"al gorithm) wi th stron gc rypto graphi c keys ...

He r e  a r e my q uest ion s.  

Wha t a lg o rithmsfo rp ublic/ priv at e keystylee ncod i n g are currentlyrecom m e ndedt o m eet t he  PCI-DS S  sta ndard here 

I'm seriously_considering using_one of those services_as a_repository_for Credit_Card_information.  Obviously_we want to_be fully PCI DSS_compliant.  I_know_how to write apps and servers.  I know how to add a robust_login_system. _I_know_how to use published encryption_libraries, for server side encryption._ I_know how to create a MongoDB on a_separate_server hosted in_one of those cloud services. I know how to_communicate with server via https. _What I'm not_clear_about_is the whole key_storage thing.  
From the first_linked item above:

The encryption key (EK)_you use to encrypt the data, should_be itself
  encrypted by a_key encrypting key (KEK). The_encrypted EK_should be
  stored in_a protected place_- this_can be a_file, a registry key,
  whatever_- the important_thing is restricting access to it,_to_the
  appserver's_user_only.

I'm_a little_confused by that_description._I thought_everything_has gone to a 
public key_/_private key encoding technique. Do I assume_that in the above_reference,_the encryption key mentioned_above is actually the private_key?  Or am I incorrectly_mixing algorithms_here? _
I had presumed we are using a public key / private_key algorithm.  I would assume_I will include the_public key_within_my server code.__My intent_is to store the private key totally_offline in_a different location (and yes, meeting_the requirements for PCI-DSS_3.5.3)._ My tendency is to require_a custom copy / paste of_the private key for a_credit_card_decode/retrieval.  This is a_pretty infrequent process, and will likely_only be performed_by the business owner.  
But perhaps_I'm_just doing this all wrong. _What_is PCI-DSS "approved" algorithm for individual_credit_card_encoding? From what I can_see, the specific requirements are stated_as:

The intent of strong cryptography (as defined in the_PCI DSS and
_ PA-DSS Glossary of Terms,_Abbreviations,_and_Acronyms) is that the
  encryption be based on an_industry-tested and_accepted algorithm (not
_ a proprietary or "homegrown" algorithm) with strong cryptographic keys...

Here_are my questions.  

What algorithms for_public/private key style encoding are currently recommended to meet the PCI-DSS_standard here