AWS payment-cryptography documentation change

Service: payment-cryptography · 2025-04-01 · Documentation medium

File: payment-cryptography/latest/userguide/keys-importexport.md

Summary

Modified supported key wrapping combinations table - removed ECDH from several cells and added TR-31 support for AES_256

Security assessment

Table updates reflect changes in supported cryptographic protocols but lack explicit security context. The AES_256 note about 521-bit curves suggests cryptographic best practices rather than addressing vulnerabilities.

Diff

diff --git a/payment-cryptography/latest/userguide/keys-importexport.md b/payment-cryptography/latest/userguide/keys-importexport.md
index db6e9ba0c..deda71642 100644
--- a/payment-cryptography/latest/userguide/keys-importexport.md
+++ b/payment-cryptography/latest/userguide/keys-importexport.md
@@ -19,5 +19,5 @@ The following table shows the supported combinations of wrapping keys, keys to p
-**TDES_2KEY** | TR-31 | TR-31 | TR-31 | TR-31 | TR-31 | TR-34, RSA,ECDH | TR-34, RSA,ECDH | RSA,ECDH | ECDH | ECDH | ECDH |   
-**TDES_3KEY** |  Not supported | TR-31 | TR-31 | TR-31 | TR-31 | TR-34, RSA,ECDH | TR-34, RSA,ECDH | RSA,ECDH | ECDH | ECDH | ECDH |   
-**AES_128** |  Not supported |  Not supported | TR-31 | TR-31 | TR-31 |  Not supported | TR-34, RSA,ECDH | RSA,ECDH | ECDH | ECDH | ECDH |   
-**AES_192** |  Not supported |  Not supported |  Not supported | TR-31 | TR-31 |  Not supported | TR-34, RSA,ECDH | RSA,ECDH |  Not supported |  Not supported | ECDH |   
-**AES_256** |  Not supported |  Not supported |  Not supported |  Not supported |  Not supported |  Not supported |  Not supported |  Not supported | ECDH | ECDH | ECDH | Import/Export of AES 256 bits keys is only permitted under ECDH using 521 length curves.  
+**TDES_2KEY** | TR-31 | TR-31 | TR-31 | TR-31 | TR-31 | TR-34, RSA | TR-34, RSA | RSA | ECDH | ECDH | ECDH |   
+**TDES_3KEY** |  Not supported | TR-31 | TR-31 | TR-31 | TR-31 | TR-34, RSA | TR-34, RSA | RSA | ECDH | ECDH | ECDH |   
+**AES_128** |  Not supported |  Not supported | TR-31 | TR-31 | TR-31 |  Not supported | TR-34, RSA | RSA | ECDH | ECDH | ECDH |   
+**AES_192** |  Not supported |  Not supported |  Not supported | TR-31 | TR-31 |  Not supported |  Not supported |  Not supported |  Not supported | ECDH | ECDH |   
+**AES_256** |  Not supported |  Not supported |  Not supported |  Not supported | TR-31 |  Not supported |  Not supported |  Not supported |  Not supported |  Not supported | ECDH |