QUOTE (Rotbart van Dainig @ Nov 24 2010, 10:27 AM)

You mean, like Credit Cards?
Yeah, a lot like that, but different. Credit cards are not stored value tokens, they are just ways to move money into and out of bank accounts on the bank back end computers. But there is mandatory encryption required everywhere. Poke around the www.pcisecuritystandards.org web site a while.
For example:
Initial Roadmap: Point-to-Point Encryption Technology and PCI DSS Compliance
4 Components of P2PE Technology
When critically examining any P2PE solution, it is important for the merchant to consider all P2PE components. These include the technologies and mechanisms enabling how the cardholder data is accepted, and how the transaction progresses through the merchant environment – including transmission to the processor/acquirer. The P2PE solution must address potential attack vectors against each component and provide the merchant with the ability to confirm with confidence that associated risks have been addressed.
4.1 P2PE Domains
P2PE domains are the areas where specific controls need to be applied and validated. These domains may be managed and controlled by separate entities.
The forthcoming Validation Requirements for Point-to-Point Encryption will specify requirements and validation procedures for at least the following key domains:
• Encryption device
• Payment Application if applicable
• Merchant encryption environment, which includes all elements still subject to PCI DSS validation
• Encryption and decryption operations and key management
• Decryption environment
• Enhanced key management practices for the decryption environment
These domains are introduced below; further details will appear in the forthcoming Validation Requirements for Point-to-Point Encryption.
4.2 Encryption Device
In general, the data that must be encrypted includes the full primary account number (PAN) and sensitive authentication data (SAD).
Implementing an encryption function within the POI device requires security against both physical and logical compromise – including properly managing, storing, and protecting cryptographic keys. The considerations applicable to any device performing encryption of CHD or sensitive authentication data with the goal of simplifying PCI DSS validation scope include but are not limited to the following:
• Appropriateness of algorithm choice, key size, key lifetime, etc.
• How the confidentiality of secret and private keys is ensured
• How integrity and authenticity of public keys are maintained
• Physical security and tamper resistance of the device
• How integrity of software components and services is maintained (including integrity of any updates)
• Generation of audit events
• Physical penetration testing
• How side channel analysis is prevented
• Verification that plaintext data is not output from the device
• How access to plaintext account data prior to encryption is prevented by the POI device
• Device administration, including administration of cryptographic keys
• Thorough documentation by the developer to assure appropriate installation