Skip to content

Commit 573b4e2

Browse files
author
awstools
committed
feat(client-payment-cryptography-data): Adding new API to generate authenticated scripts for EMV pin change use cases.
1 parent c046f87 commit 573b4e2

17 files changed

+1846
-288
lines changed

‎clients/client-payment-cryptography-data/README.md

+8
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,14 @@ GenerateMac
235235

236236
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/payment-cryptography-data/command/GenerateMacCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-payment-cryptography-data/Interface/GenerateMacCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-payment-cryptography-data/Interface/GenerateMacCommandOutput/)
237237

238+
</details>
239+
<details>
240+
<summary>
241+
GenerateMacEmvPinChange
242+
</summary>
243+
244+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/payment-cryptography-data/command/GenerateMacEmvPinChangeCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-payment-cryptography-data/Interface/GenerateMacEmvPinChangeCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-payment-cryptography-data/Interface/GenerateMacEmvPinChangeCommandOutput/)
245+
238246
</details>
239247
<details>
240248
<summary>

‎clients/client-payment-cryptography-data/src/PaymentCryptographyData.ts

+23
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@ import {
1010
GenerateCardValidationDataCommandOutput,
1111
} from "./commands/GenerateCardValidationDataCommand";
1212
import { GenerateMacCommand, GenerateMacCommandInput, GenerateMacCommandOutput } from "./commands/GenerateMacCommand";
13+
import {
14+
GenerateMacEmvPinChangeCommand,
15+
GenerateMacEmvPinChangeCommandInput,
16+
GenerateMacEmvPinChangeCommandOutput,
17+
} from "./commands/GenerateMacEmvPinChangeCommand";
1318
import {
1419
GeneratePinDataCommand,
1520
GeneratePinDataCommandInput,
@@ -48,6 +53,7 @@ const commands = {
4853
EncryptDataCommand,
4954
GenerateCardValidationDataCommand,
5055
GenerateMacCommand,
56+
GenerateMacEmvPinChangeCommand,
5157
GeneratePinDataCommand,
5258
ReEncryptDataCommand,
5359
TranslatePinDataCommand,
@@ -108,6 +114,23 @@ export interface PaymentCryptographyData {
108114
cb: (err: any, data?: GenerateMacCommandOutput) => void
109115
): void;
110116

117+
/**
118+
* @see {@link GenerateMacEmvPinChangeCommand}
119+
*/
120+
generateMacEmvPinChange(
121+
args: GenerateMacEmvPinChangeCommandInput,
122+
options?: __HttpHandlerOptions
123+
): Promise<GenerateMacEmvPinChangeCommandOutput>;
124+
generateMacEmvPinChange(
125+
args: GenerateMacEmvPinChangeCommandInput,
126+
cb: (err: any, data?: GenerateMacEmvPinChangeCommandOutput) => void
127+
): void;
128+
generateMacEmvPinChange(
129+
args: GenerateMacEmvPinChangeCommandInput,
130+
options: __HttpHandlerOptions,
131+
cb: (err: any, data?: GenerateMacEmvPinChangeCommandOutput) => void
132+
): void;
133+
111134
/**
112135
* @see {@link GeneratePinDataCommand}
113136
*/

‎clients/client-payment-cryptography-data/src/PaymentCryptographyDataClient.ts

+6
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,10 @@ import {
6060
GenerateCardValidationDataCommandOutput,
6161
} from "./commands/GenerateCardValidationDataCommand";
6262
import { GenerateMacCommandInput, GenerateMacCommandOutput } from "./commands/GenerateMacCommand";
63+
import {
64+
GenerateMacEmvPinChangeCommandInput,
65+
GenerateMacEmvPinChangeCommandOutput,
66+
} from "./commands/GenerateMacEmvPinChangeCommand";
6367
import { GeneratePinDataCommandInput, GeneratePinDataCommandOutput } from "./commands/GeneratePinDataCommand";
6468
import { ReEncryptDataCommandInput, ReEncryptDataCommandOutput } from "./commands/ReEncryptDataCommand";
6569
import { TranslatePinDataCommandInput, TranslatePinDataCommandOutput } from "./commands/TranslatePinDataCommand";
@@ -92,6 +96,7 @@ export type ServiceInputTypes =
9296
| EncryptDataCommandInput
9397
| GenerateCardValidationDataCommandInput
9498
| GenerateMacCommandInput
99+
| GenerateMacEmvPinChangeCommandInput
95100
| GeneratePinDataCommandInput
96101
| ReEncryptDataCommandInput
97102
| TranslatePinDataCommandInput
@@ -108,6 +113,7 @@ export type ServiceOutputTypes =
108113
| EncryptDataCommandOutput
109114
| GenerateCardValidationDataCommandOutput
110115
| GenerateMacCommandOutput
116+
| GenerateMacEmvPinChangeCommandOutput
111117
| GeneratePinDataCommandOutput
112118
| ReEncryptDataCommandOutput
113119
| TranslatePinDataCommandOutput

‎clients/client-payment-cryptography-data/src/commands/DecryptDataCommand.ts

+10-9
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@ export interface DecryptDataCommandOutput extends DecryptDataOutput, __MetadataB
3838

3939
/**
4040
* <p>Decrypts ciphertext data to plaintext using a symmetric (TDES, AES), asymmetric (RSA), or derived (DUKPT or EMV) encryption key scheme. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/decrypt-data.html">Decrypt data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
41-
* <p>You can use an encryption key generated within Amazon Web Services Payment Cryptography, or you can import your own encryption key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. For this operation, the key must have <code>KeyModesOfUse</code> set to <code>Decrypt</code>. In asymmetric decryption, Amazon Web Services Payment Cryptography decrypts the ciphertext using the private component of the asymmetric encryption key pair. For data encryption outside of Amazon Web Services Payment Cryptography, you can export the public component of the asymmetric key pair by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_GetPublicKeyCertificate.html">GetPublicCertificate</a>.</p>
41+
* <p>You can use an decryption key generated within Amazon Web Services Payment Cryptography, or you can import your own decryption key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. For this operation, the key must have <code>KeyModesOfUse</code> set to <code>Decrypt</code>. In asymmetric decryption, Amazon Web Services Payment Cryptography decrypts the ciphertext using the private component of the asymmetric encryption key pair. For data encryption outside of Amazon Web Services Payment Cryptography, you can export the public component of the asymmetric key pair by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_GetPublicKeyCertificate.html">GetPublicCertificate</a>.</p>
42+
* <p>This operation also supports dynamic keys, allowing you to pass a dynamic decryption key as a TR-31 WrappedKeyBlock. This can be used when key material is frequently rotated, such as during every card transaction, and there is need to avoid importing short-lived keys into Amazon Web Services Payment Cryptography. To decrypt using dynamic keys, the <code>keyARN</code> is the Key Encryption Key (KEK) of the TR-31 wrapped decryption key material. The incoming wrapped key shall have a key purpose of D0 with a mode of use of B or D. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-acquirers-dynamickeys.html">Using Dynamic Keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
4243
* <p>For symmetric and DUKPT decryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> algorithms. For EMV decryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> algorithms. For asymmetric decryption, Amazon Web Services Payment Cryptography supports <code>RSA</code>. </p>
4344
* <p>When you use TDES or TDES DUKPT, the ciphertext data length must be a multiple of 8 bytes. For AES or AES DUKPT, the ciphertext data length must be a multiple of 16 bytes. For RSA, it sould be equal to the key size unless padding is enabled.</p>
4445
* <p>For information about valid keys for this operation, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html">Understanding key attributes</a> and <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p>
@@ -75,26 +76,26 @@ export interface DecryptDataCommandOutput extends DecryptDataOutput, __MetadataB
7576
* CipherText: "STRING_VALUE", // required
7677
* DecryptionAttributes: { // EncryptionDecryptionAttributes Union: only one key present
7778
* Symmetric: { // SymmetricEncryptionAttributes
78-
* Mode: "STRING_VALUE", // required
79+
* Mode: "ECB" || "CBC" || "CFB" || "CFB1" || "CFB8" || "CFB64" || "CFB128" || "OFB", // required
7980
* InitializationVector: "STRING_VALUE",
80-
* PaddingType: "STRING_VALUE",
81+
* PaddingType: "PKCS1" || "OAEP_SHA1" || "OAEP_SHA256" || "OAEP_SHA512",
8182
* },
8283
* Asymmetric: { // AsymmetricEncryptionAttributes
83-
* PaddingType: "STRING_VALUE",
84+
* PaddingType: "PKCS1" || "OAEP_SHA1" || "OAEP_SHA256" || "OAEP_SHA512",
8485
* },
8586
* Dukpt: { // DukptEncryptionAttributes
8687
* KeySerialNumber: "STRING_VALUE", // required
87-
* Mode: "STRING_VALUE",
88-
* DukptKeyDerivationType: "STRING_VALUE",
89-
* DukptKeyVariant: "STRING_VALUE",
88+
* Mode: "ECB" || "CBC",
89+
* DukptKeyDerivationType: "TDES_2KEY" || "TDES_3KEY" || "AES_128" || "AES_192" || "AES_256",
90+
* DukptKeyVariant: "BIDIRECTIONAL" || "REQUEST" || "RESPONSE",
9091
* InitializationVector: "STRING_VALUE",
9192
* },
9293
* Emv: { // EmvEncryptionAttributes
93-
* MajorKeyDerivationMode: "STRING_VALUE", // required
94+
* MajorKeyDerivationMode: "EMV_OPTION_A" || "EMV_OPTION_B", // required
9495
* PrimaryAccountNumber: "STRING_VALUE", // required
9596
* PanSequenceNumber: "STRING_VALUE", // required
9697
* SessionDerivationData: "STRING_VALUE", // required
97-
* Mode: "STRING_VALUE",
98+
* Mode: "ECB" || "CBC",
9899
* InitializationVector: "STRING_VALUE",
99100
* },
100101
* },

‎clients/client-payment-cryptography-data/src/commands/EncryptDataCommand.ts

+11-9
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,9 @@ export interface EncryptDataCommandOutput extends EncryptDataOutput, __MetadataB
3838

3939
/**
4040
* <p>Encrypts plaintext data to ciphertext using a symmetric (TDES, AES), asymmetric (RSA), or derived (DUKPT or EMV) encryption key scheme. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/encrypt-data.html">Encrypt data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
41-
* <p>You can generate an encryption key within Amazon Web Services Payment Cryptography by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html">CreateKey</a>. You can import your own encryption key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. For this operation, the key must have <code>KeyModesOfUse</code> set to <code>Encrypt</code>. In asymmetric encryption, plaintext is encrypted using public component. You can import the public component of an asymmetric key pair created outside Amazon Web Services Payment Cryptography by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. </p>
41+
* <p>You can generate an encryption key within Amazon Web Services Payment Cryptography by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html">CreateKey</a>. You can import your own encryption key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>.</p>
42+
* <p>For this operation, the key must have <code>KeyModesOfUse</code> set to <code>Encrypt</code>. In asymmetric encryption, plaintext is encrypted using public component. You can import the public component of an asymmetric key pair created outside Amazon Web Services Payment Cryptography by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. </p>
43+
* <p>This operation also supports dynamic keys, allowing you to pass a dynamic encryption key as a TR-31 WrappedKeyBlock. This can be used when key material is frequently rotated, such as during every card transaction, and there is need to avoid importing short-lived keys into Amazon Web Services Payment Cryptography. To encrypt using dynamic keys, the <code>keyARN</code> is the Key Encryption Key (KEK) of the TR-31 wrapped encryption key material. The incoming wrapped key shall have a key purpose of D0 with a mode of use of B or D. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-acquirers-dynamickeys.html">Using Dynamic Keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
4244
* <p>For symmetric and DUKPT encryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> algorithms. For EMV encryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> algorithms.For asymmetric encryption, Amazon Web Services Payment Cryptography supports <code>RSA</code>. </p>
4345
* <p>When you use TDES or TDES DUKPT, the plaintext data length must be a multiple of 8 bytes. For AES or AES DUKPT, the plaintext data length must be a multiple of 16 bytes. For RSA, it sould be equal to the key size unless padding is enabled.</p>
4446
* <p>To encrypt using DUKPT, you must already have a BDK (Base Derivation Key) key in your account with <code>KeyModesOfUse</code> set to <code>DeriveKey</code>, or you can generate a new DUKPT key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html">CreateKey</a>. To encrypt using EMV, you must already have an IMK (Issuer Master Key) key in your account with <code>KeyModesOfUse</code> set to <code>DeriveKey</code>.</p>
@@ -81,26 +83,26 @@ export interface EncryptDataCommandOutput extends EncryptDataOutput, __MetadataB
8183
* PlainText: "STRING_VALUE", // required
8284
* EncryptionAttributes: { // EncryptionDecryptionAttributes Union: only one key present
8385
* Symmetric: { // SymmetricEncryptionAttributes
84-
* Mode: "STRING_VALUE", // required
86+
* Mode: "ECB" || "CBC" || "CFB" || "CFB1" || "CFB8" || "CFB64" || "CFB128" || "OFB", // required
8587
* InitializationVector: "STRING_VALUE",
86-
* PaddingType: "STRING_VALUE",
88+
* PaddingType: "PKCS1" || "OAEP_SHA1" || "OAEP_SHA256" || "OAEP_SHA512",
8789
* },
8890
* Asymmetric: { // AsymmetricEncryptionAttributes
89-
* PaddingType: "STRING_VALUE",
91+
* PaddingType: "PKCS1" || "OAEP_SHA1" || "OAEP_SHA256" || "OAEP_SHA512",
9092
* },
9193
* Dukpt: { // DukptEncryptionAttributes
9294
* KeySerialNumber: "STRING_VALUE", // required
93-
* Mode: "STRING_VALUE",
94-
* DukptKeyDerivationType: "STRING_VALUE",
95-
* DukptKeyVariant: "STRING_VALUE",
95+
* Mode: "ECB" || "CBC",
96+
* DukptKeyDerivationType: "TDES_2KEY" || "TDES_3KEY" || "AES_128" || "AES_192" || "AES_256",
97+
* DukptKeyVariant: "BIDIRECTIONAL" || "REQUEST" || "RESPONSE",
9698
* InitializationVector: "STRING_VALUE",
9799
* },
98100
* Emv: { // EmvEncryptionAttributes
99-
* MajorKeyDerivationMode: "STRING_VALUE", // required
101+
* MajorKeyDerivationMode: "EMV_OPTION_A" || "EMV_OPTION_B", // required
100102
* PrimaryAccountNumber: "STRING_VALUE", // required
101103
* PanSequenceNumber: "STRING_VALUE", // required
102104
* SessionDerivationData: "STRING_VALUE", // required
103-
* Mode: "STRING_VALUE",
105+
* Mode: "ECB" || "CBC",
104106
* InitializationVector: "STRING_VALUE",
105107
* },
106108
* },

‎clients/client-payment-cryptography-data/src/commands/GenerateMacCommand.ts

+9-9
Original file line numberDiff line numberDiff line change
@@ -63,31 +63,31 @@ export interface GenerateMacCommandOutput extends GenerateMacOutput, __MetadataB
6363
* KeyIdentifier: "STRING_VALUE", // required
6464
* MessageData: "STRING_VALUE", // required
6565
* GenerationAttributes: { // MacAttributes Union: only one key present
66-
* Algorithm: "STRING_VALUE",
66+
* Algorithm: "ISO9797_ALGORITHM1" || "ISO9797_ALGORITHM3" || "CMAC" || "HMAC_SHA224" || "HMAC_SHA256" || "HMAC_SHA384" || "HMAC_SHA512",
6767
* EmvMac: { // MacAlgorithmEmv
68-
* MajorKeyDerivationMode: "STRING_VALUE", // required
68+
* MajorKeyDerivationMode: "EMV_OPTION_A" || "EMV_OPTION_B", // required
6969
* PrimaryAccountNumber: "STRING_VALUE", // required
7070
* PanSequenceNumber: "STRING_VALUE", // required
71-
* SessionKeyDerivationMode: "STRING_VALUE", // required
71+
* SessionKeyDerivationMode: "EMV_COMMON_SESSION_KEY" || "EMV2000" || "AMEX" || "MASTERCARD_SESSION_KEY" || "VISA", // required
7272
* SessionKeyDerivationValue: { // SessionKeyDerivationValue Union: only one key present
7373
* ApplicationCryptogram: "STRING_VALUE",
7474
* ApplicationTransactionCounter: "STRING_VALUE",
7575
* },
7676
* },
7777
* DukptIso9797Algorithm1: { // MacAlgorithmDukpt
7878
* KeySerialNumber: "STRING_VALUE", // required
79-
* DukptKeyVariant: "STRING_VALUE", // required
80-
* DukptDerivationType: "STRING_VALUE",
79+
* DukptKeyVariant: "BIDIRECTIONAL" || "REQUEST" || "RESPONSE", // required
80+
* DukptDerivationType: "TDES_2KEY" || "TDES_3KEY" || "AES_128" || "AES_192" || "AES_256",
8181
* },
8282
* DukptIso9797Algorithm3: {
8383
* KeySerialNumber: "STRING_VALUE", // required
84-
* DukptKeyVariant: "STRING_VALUE", // required
85-
* DukptDerivationType: "STRING_VALUE",
84+
* DukptKeyVariant: "BIDIRECTIONAL" || "REQUEST" || "RESPONSE", // required
85+
* DukptDerivationType: "TDES_2KEY" || "TDES_3KEY" || "AES_128" || "AES_192" || "AES_256",
8686
* },
8787
* DukptCmac: {
8888
* KeySerialNumber: "STRING_VALUE", // required
89-
* DukptKeyVariant: "STRING_VALUE", // required
90-
* DukptDerivationType: "STRING_VALUE",
89+
* DukptKeyVariant: "BIDIRECTIONAL" || "REQUEST" || "RESPONSE", // required
90+
* DukptDerivationType: "TDES_2KEY" || "TDES_3KEY" || "AES_128" || "AES_192" || "AES_256",
9191
* },
9292
* },
9393
* MacLength: Number("int"),

0 commit comments

Comments
 (0)