AWS payment-cryptography documentation change

Service: payment-cryptography · 2026-01-31 · Documentation medium

File: payment-cryptography/latest/userguide/create-keys.md

Summary

Added HMAC key creation documentation including CLI example, output format, and usage notes

Security assessment

Documents HMAC key creation for message authentication codes (security feature), but doesn't address vulnerabilities. Enhances security documentation by adding cryptographic controls for data integrity verification.

Diff

diff --git a/payment-cryptography/latest/userguide/create-keys.md b/payment-cryptography/latest/userguide/create-keys.md
index e3c2d4454..0624ea35c 100644
--- a//payment-cryptography/latest/userguide/create-keys.md
+++ b//payment-cryptography/latest/userguide/create-keys.md
@@ -5 +5 @@
-Creating a 3KEY TDES base derivation keyCreating a 2KEY TDES key for CVV/CVV2Creating a PIN Encryption Key (PEK)Creating an asymmetric (RSA) keyCreating a PIN Verification Value (PVV) KeyCreating an asymmetric ECC key
+Creating a 3KEY TDES base derivation keyCreating a 2KEY TDES key for CVV/CVV2Creating an HMAC keyCreating a PIN Encryption Key (PEK)Creating an asymmetric (RSA) keyCreating a PIN Verification Value (PVV) KeyCreating an asymmetric ECC key
@@ -14,0 +15,19 @@ If Multi-Region key replication is enabled for your AWS account and you create a
+###### Examples
+
+  * Creating a 3KEY TDES base derivation key
+
+  * Creating a 2KEY TDES key for CVV/CVV2
+
+  * Creating an HMAC key
+
+  * Creating a PIN Encryption Key (PEK)
+
+  * Creating an asymmetric (RSA) key
+
+  * Creating a PIN Verification Value (PVV) Key
+
+  * Creating an asymmetric ECC key
+
+
+
+
@@ -99,0 +119,40 @@ Example output:
+## Creating an HMAC key
+
+HMAC keys are used for generating or verifying hash message authentication codes (HMAC). With HMAC keys, the hash type is assigned at the time of key creation (such as HMAC_SHA224 and HMAC_SHA512) and cannot be modified. 
+    
+    
+    $ aws payment-cryptography create-key --exportable --key-attributes KeyAlgorithm=HMAC_SHA512,KeyUsage=TR31_M7_HMAC_KEY,KeyClass=SYMMETRIC_KEY,KeyModesOfUse='{Generate = true,Verify = true}'
+
+Example output:
+    
+    
+    {
+     "Key": {
+     "KeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/qnobl5lghrzunce6",
+     "KeyAttributes": {
+     "KeyUsage": "TR31_M7_HMAC_KEY",
+     "KeyClass": "SYMMETRIC_KEY",
+     "KeyAlgorithm": "HMAC_SHA512",
+     "KeyModesOfUse": {
+     "Encrypt": false,
+     "Decrypt": false,
+     "Wrap": false,
+     "Unwrap": false,
+     "Generate": true,
+     "Sign": false,
+     "Verify": true,
+     "DeriveKey": false,
+     "NoRestrictions": false
+     }
+     },
+     "KeyCheckValue": "2976E7",
+     "KeyCheckValueAlgorithm": "HMAC",
+     "Enabled": true,
+     "Exportable": true,
+     "KeyState": "CREATE_COMPLETE",
+     "KeyOrigin": "AWS_PAYMENT_CRYPTOGRAPHY",
+     "CreateTimestamp": "2025-07-30T10:06:12.142000-07:00",
+     "UsageStartTimestamp": "2025-07-30T10:06:12.128000-07:00"
+     }
+    }
+