AWS payment-cryptography documentation change

Service: payment-cryptography · 2026-01-31 · Documentation medium

File: payment-cryptography/latest/userguide/crypto-ops-mac.md

Summary

Added documentation for AS2805.4.1 MAC, DUKPT MAC, and EMV MAC algorithms including key usage types and security applications

Security assessment

Expands documentation of message authentication code implementations (security features) for payment systems. No vulnerability fixes, but strengthens security guidance for cryptographic operations in payment processing.

Diff

diff --git a/payment-cryptography/latest/userguide/crypto-ops-mac.md b/payment-cryptography/latest/userguide/crypto-ops-mac.md
index 20b2256c0..be986cc97 100644
--- a//payment-cryptography/latest/userguide/crypto-ops-mac.md
+++ b//payment-cryptography/latest/userguide/crypto-ops-mac.md
@@ -32,0 +33,15 @@ Denoted by `KeyUsage` of TR31_M7_HMAC_KEY including HMAC_SHA224, HMAC_SHA256, HM
+**AS2805.4.1 MAC**
+    
+
+Denoted by `KeyUsage` of TR31_M0_ISO_16609_MAC_KEY. For more details on AS2805, see [AS2805](./advanced.regional.as2805.html)
+
+**DUKPT MAC**
+    
+
+DUKPT MAC is typically used to confirm the source and payload of messages to/from payment terminals. It derives a key using DUKPT derivation techniques and then performs the MAC. Keys used with this option are denoted by a `KeyUsage` of TR31_B0_BASE_DERIVATION_KEY. 
+
+**EMV MAC**
+    
+
+EMV MAC is typically referred to as an integrity key in EMV documentation. It derives a key using EMV derivation techniques and then utilizes ISO9797_ALGORITHM3 internally. It is typically used to send issuer scripts to a chip card for reprogramming. Keys used with this option are denoted by a `KeyUsage` of TR31_E2_EMV_MKEY_INTEGRITY. If you are both sending a script and update an offline pin, see [GenerateMacEmvPinChange](https://docs.aws.amazon.com/payment-cryptography/latest/DataAPIReference/API_GenerateMacEmvPinChange) that performs both of these operations. 
+