@AndrolGenhald TPMs can be locked with a user-supplied password.
@Moytaba It is distributed just like the regular symmetric key.
A "shared secret" is exchanged or derived, and it is used to deterministically generate both the symmetric key and the MAC key (as well as other stuff like the nonce).
I'm feeling super confused by the whole PCI DSS business. I'm working with a local, HK-based eCommerce SaaS vendor for my eCommerce website - they provide everything from web development to hosting, as well as payment gateway integration (we use PayPal Checkout). From here, I know that I can proc...