AWS payment-cryptography documentation change
Summary
Added KBPK (Key Block Protection Key) definition and clarification about TR-31 key types
Security assessment
New documentation explains security-related key management concepts but does not address specific vulnerabilities. Enhances understanding of cryptographic controls.
Diff
diff --git a/payment-cryptography/latest/userguide/terminology.md b/payment-cryptography/latest/userguide/terminology.md index d86634ae6..ba8dd3d02 100644 --- a/payment-cryptography/latest/userguide/terminology.md +++ b/payment-cryptography/latest/userguide/terminology.md @@ -74,0 +75,5 @@ An issuer working key (IWK) is a key typically used to exchange data between an +**KBPK** + + +A key block encryption key(KBPK) is a type of symmetric key used to protect key blocks and thus wrap/encrypt other keys. A KBPK is similar to a KEK but a KEK directly protects the key material whereas in TR-31 and similar schemes, the KBPK only indirectly protects the working key. When using TR-31, _TR31_K1_KEY_BLOCK_PROTECTION_KEY_ is the correct key type, although TR31_K0_KEY_ENCRYPTION_KEY is supported interchangeably for historical purposes. +