AWS payment-cryptography documentation change
Summary
Added reference to Physical Key Exchange as built-in KCAAS capability
Security assessment
Documents AWS's built-in key management security feature for converting paper-based keys, improving clarity about PCI-compliant options without addressing vulnerabilities.
Diff
diff --git a/payment-cryptography/latest/userguide/terminology.md b/payment-cryptography/latest/userguide/terminology.md index d9fc0d08e..df01d1eb3 100644 --- a//payment-cryptography/latest/userguide/terminology.md +++ b//payment-cryptography/latest/userguide/terminology.md @@ -169 +169 @@ A Hardware Security Module (HSM) is a physical device that protects cryptographi -A Key Custodian As A Service (KCAAS) provides a variety of services relating to key management. For payment keys, they can typically convert paper-based key components to electronic forms supported by AWS Payment Cryptography or convert electronically protected keys to paper-based components that might be required by certain vendors. They may also provide key escrow services for keys whose loss would be detrimental to your ongoing opeations. KCAAS vendors are able to help customers offload the operational burden of managing key material outside a secure service such as AWS Payment Cryptography in a way compliant with PCI DSS, PCI PIN, and PCI P2PE standards. +A Key Custodian As A Service (KCAAS) provides a variety of services relating to key management. For payment keys, they can typically convert paper-based key components to electronic forms supported by AWS Payment Cryptography or convert electronically protected keys to paper-based components that might be required by certain vendors. They may also provide key escrow services for keys whose loss would be detrimental to your ongoing operations. KCAAS vendors are able to help customers offload the operational burden of managing key material outside a secure service such as AWS Payment Cryptography in a way compliant with PCI DSS, PCI PIN, and PCI P2PE standards. AWS Payment Cryptography offers [Physical Key Exchange](./keys-physicalkeyexchange.html) as a built-in KCAAS capability for converting paper-based key components into electronic format.