AWS Security ChangesHomeSearch

AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2025-04-16 · Documentation medium

File: AWSCloudFormation/latest/UserGuide/aws-resource-paymentcryptography-key.md

Summary

Added DeriveKeyUsage property with TR-31 spec compliance details and expanded KeyUsageAllowedValues

Security assessment

Introduces documentation for new cryptographic key usage standards (TR-31 spec) and expands HMAC support, enhancing security feature documentation without addressing a specific vulnerability.

Diff

diff --git a/AWSCloudFormation/latest/UserGuide/aws-resource-paymentcryptography-key.md b/AWSCloudFormation/latest/UserGuide/aws-resource-paymentcryptography-key.md
index d50d02b42..d179dbfb5 100644
--- a//AWSCloudFormation/latest/UserGuide/aws-resource-paymentcryptography-key.md
+++ b//AWSCloudFormation/latest/UserGuide/aws-resource-paymentcryptography-key.md
@@ -41,0 +42 @@ To declare this entity in your AWS CloudFormation template, use the following sy
+          "DeriveKeyUsage" : String,
@@ -55,0 +57 @@ To declare this entity in your AWS CloudFormation template, use the following sy
+      DeriveKeyUsage: String
@@ -66,0 +69,13 @@ To declare this entity in your AWS CloudFormation template, use the following sy
+`DeriveKeyUsage`
+    
+
+The cryptographic usage of an ECDH derived key as defined in section A.5.2 of the TR-31 spec.
+
+_Required_ : No
+
+ _Type_ : String
+
+ _Allowed values_ : `TR31_B0_BASE_DERIVATION_KEY | TR31_C0_CARD_VERIFICATION_KEY | TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY | TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS | TR31_E1_EMV_MKEY_CONFIDENTIALITY | TR31_E2_EMV_MKEY_INTEGRITY | TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS | TR31_E5_EMV_MKEY_CARD_PERSONALIZATION | TR31_E6_EMV_MKEY_OTHER | TR31_K0_KEY_ENCRYPTION_KEY | TR31_K1_KEY_BLOCK_PROTECTION_KEY | TR31_M3_ISO_9797_3_MAC_KEY | TR31_M1_ISO_9797_1_MAC_KEY | TR31_M6_ISO_9797_5_CMAC_KEY | TR31_M7_HMAC_KEY | TR31_P0_PIN_ENCRYPTION_KEY | TR31_P1_PIN_GENERATION_KEY | TR31_V1_IBM3624_PIN_VERIFICATION_KEY | TR31_V2_VISA_PIN_VERIFICATION_KEY`
+
+ _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+
@@ -111 +126 @@ _Required_ : No
- _Allowed values_ : `CMAC | ANSI_X9_24`
+ _Allowed values_ : `CMAC | ANSI_X9_24 | HMAC`