AWS payment-cryptography high security documentation change
Summary
Corrected definition of KP field to clarify KBPK key validation usage
Security assessment
Fixes critical documentation error regarding cryptographic key validation. Original misattribution of KCV to wrapping key could lead to implementation flaws affecting key security.
Diff
diff --git a/payment-cryptography/latest/userguide/keys-export.md b/payment-cryptography/latest/userguide/keys-export.md index 601ff686a..968e0ba36 100644 --- a//payment-cryptography/latest/userguide/keys-export.md +++ b//payment-cryptography/latest/userguide/keys-export.md @@ -592 +592 @@ KS | Initial Key Serial Number for TDES DUKPT | 20 hex characters | This value -KP | [KCV](./terminology.html#terms.kcv) of the wrapping key | 2 hex characters represent the KCV method (00 for X9.24 method and 01 for CMAC method). Followed by KCV value which is typically 6 hex characters. For example 010FA329 represents KCV of 0FA329 calculated using 01(CMAC) method. | This value is used to instantiate the use of the Initial DUKPT key on the receiving device and it identifies the Initial Key derived from a BDK. This field typically contains the derivation data + a zeroized counter value. Use IK for AES DUKPT. +KP | Key check value of the [KBPK](./terminology.html#terms.kbpk) | 2 hex characters represent the KCV method (00 for X9.24 method and 01 for CMAC method). Followed by KCV value which is typically 6 hex characters. For example 010FA329 represents KCV of 0FA329 calculated using 01(CMAC) method. | Computed according to ANSI X9.24-1-2017 Annex A; the KCV is used for key validation not as an integrity mechanism.