AWS payment-cryptography documentation change
Summary
Updated DUKPT CMAC example: rewrote introductory text, changed parameter from 'Direction' to 'DukptKeyVariant', and added missing 'Mac' field to example output
Security assessment
This change updates documentation for a security feature (MAC generation using DUKPT with CMAC for card data authentication). The parameter name change from 'Direction' to 'DukptKeyVariant' appears to be an API correction/update. While this documents security functionality, there's no evidence of addressing a specific security vulnerability.
Diff
diff --git a/payment-cryptography/latest/userguide/generate-mac.md b/payment-cryptography/latest/userguide/generate-mac.md index 9d627aa08..80608f873 100644 --- a//payment-cryptography/latest/userguide/generate-mac.md +++ b//payment-cryptography/latest/userguide/generate-mac.md @@ -108 +108,3 @@ CMAC is most commonly used when the keys are AES but it also supports TDES. In t -In this example, we will generate a MAC using DUKPT (Derived Unique Key Per Transaction) with CMAC for card data authentication. The key must have KeyUsage set to `TR31_B0_BASE_DERIVATION_KEY` and KeyModesOfUse `DeriveKey` set to true. DUKPT keys derive a unique key for each transaction using a Base Derivation Key (BDK) and a Key Serial Number (KSN). +This example generates a MAC using DUKPT (Derived Unique Key Per Transaction) with CMAC for card data authentication. The key must have KeyUsage set to `TR31_B0_BASE_DERIVATION_KEY` and KeyModesOfUse `DeriveKey` set to true. + +DUKPT keys derive a unique key for each transaction using a Base Derivation Key (BDK) and a Key Serial Number (KSN). @@ -113 +115 @@ In this example, we will generate a MAC using DUKPT (Derived Unique Key Per Tran - $ aws payment-cryptography-data generate-mac --key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/qnobl5lghrzunce6 --message-data "3b313038383439303031303733393431353d32343038323236303030373030303f33" --generation-attributes="DukptCmac={KeySerialNumber="932A6E954ABB32DD00000001",Direction=BIDIRECTIONAL}" + $ aws payment-cryptography-data generate-mac --key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/qnobl5lghrzunce6 --message-data "3b313038383439303031303733393431353d32343038323236303030373030303f33" --generation-attributes="DukptCmac={KeySerialNumber="932A6E954ABB32DD00000001",DukptKeyVariant=BIDIRECTIONAL}" @@ -120 +122,2 @@ In this example, we will generate a MAC using DUKPT (Derived Unique Key Per Tran - "KeyCheckValue": "C1EB8F" + "KeyCheckValue": "C1EB8F", + "Mac": "1F8C36E63F91E4E93DF7842BF5E2E5F7"