AWS payment-cryptography documentation change
Summary
Clarified ARQC generation capabilities during development in service description
Security assessment
Expands documentation of security feature (ARQC verification) by noting service can generate ARQC for development. No vulnerability addressed.
Diff
diff --git a/payment-cryptography/latest/userguide/data-operations.verifyauthrequestcryptogram.md b/payment-cryptography/latest/userguide/data-operations.verifyauthrequestcryptogram.md index fdfc77fc7..4084c1670 100644 --- a//payment-cryptography/latest/userguide/data-operations.verifyauthrequestcryptogram.md +++ b//payment-cryptography/latest/userguide/data-operations.verifyauthrequestcryptogram.md @@ -11 +11 @@ Building transaction dataTransaction data paddingExamples -The verify auth request cryptogram API is used for verifying [ARQC](./terminology.html#terms.arqc). The generation of the ARQC is outside of the scope of the AWS Payment Cryptography and is typically performed on an EMV Chip Card (or digital equivalent such as mobile wallet) during transaction authorization time. An ARQC is unique to each transactions and is intended to cryptographically show both the validity of the card as well as to ensure that the transaction data exactly matches the current (expected) transaction. +The verify auth request cryptogram API is used for verifying [ARQC](./terminology.html#terms.arqc). The generation of the ARQC is typically performed on an EMV Chip Card (or digital equivalent such as mobile wallet) during transaction authorization time although the service can generate for development purposes. An ARQC is unique to each transactions and is intended to cryptographically show both the validity of the card as well as to ensure that the transaction data exactly matches the current (expected) transaction.