AWS payment-cryptography documentation change
Summary
Added details about ISO9797 Algorithms 1 and 3 support and clarified padding rules for MAC operations.
Security assessment
The changes provide technical clarity on cryptographic operations, which improves security documentation but do not address a specific vulnerability.
Diff
diff --git a/payment-cryptography/latest/userguide/crypto-ops-mac.md b/payment-cryptography/latest/userguide/crypto-ops-mac.md index aacd4345e..20b2256c0 100644 --- a//payment-cryptography/latest/userguide/crypto-ops-mac.md +++ b//payment-cryptography/latest/userguide/crypto-ops-mac.md @@ -7 +7 @@ -Message Authentication Codes (MAC) are typically used to authenticate the integrity of a message (whether it's been modified). Cryptographic hashes such as HMAC (Hash-Based Message Authentication Code), CBC-MAC and CMAC (Cipher-based Message Authentication Code) additionally provide additional assurance of the sender of the MAC by utilizing cryptography. HMAC is based on hash functions while CMAC is based on block ciphers. +Message Authentication Codes (MAC) are typically used to authenticate the integrity of a message (whether it's been modified). Cryptographic hashes such as HMAC (Hash-Based Message Authentication Code), CBC-MAC and CMAC (Cipher-based Message Authentication Code) provide additional assurance of the sender of the MAC by utilizing cryptography. HMAC is based on hash functions while CMAC is based on block ciphers. The service also supports ISO9797 Algorithms 1 and 3 which are types of CBC-MACs. @@ -16 +16 @@ AWS Payment Cryptography supports several types of MACs: -Denoted by `KeyUsage` of ISO9797_ALGORITHM1 +Denoted by `KeyUsage` of ISO9797_ALGORITHM1. If the field isn't a multiple of block size (8 bytes/16 hex characters for TDES, 16 bytes/32 characters for AES, AWS Payment Cryptography automatically applies ISO9797 Padding Method 1. If other padding methods are needed, you can apply them prior to calling the service. @@ -21 +21 @@ Denoted by `KeyUsage` of ISO9797_ALGORITHM1 -Denoted by `KeyUsage` of ISO9797_ALGORITHM3 +Denoted by `KeyUsage` of ISO9797_ALGORITHM3. The same padding rules apply as Algorithm 1