From 16a893e70ac43ae1172529cde98435539be7e8a6 Mon Sep 17 00:00:00 2001
From: J8k3 <jacob.marks@gmail.com>
Date: Sat, 23 May 2026 14:05:23 -0400
Subject: [PATCH] test(payment): add 5 golden-value tests for AES ECB, AES CTR,
 DUKPT TDES CBC

Covers the remaining untested cipher profiles in PaymentEncryptData /
PaymentDecryptData. Values are pinned from a clean run against the forge
upstream library, catching regressions in mode selection, IV wiring,
and padding behaviour without re-deriving cryptographic outputs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 tests/operations/tests/Payment.mjs | 62 ++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/tests/operations/tests/Payment.mjs b/tests/operations/tests/Payment.mjs
index b252d094..1f124468 100644
--- a/tests/operations/tests/Payment.mjs
+++ b/tests/operations/tests/Payment.mjs
@@ -1167,6 +1167,68 @@ TestRegister.addTests([
             }
         ]
     },
+    {
+        // Golden-value tests: verify wrapper arg wiring and padding behaviour are
+        // stable. AES is backed by the upstream forge library; these tests catch
+        // regressions in mode selection, IV handling, and key plumbing.
+        // ISO 9797-1 method-2 padding: 16-byte input → 32-byte ciphertext (data + padding block).
+        name: "Payment Encrypt Data: AES ECB",
+        input: "00112233445566778899AABBCCDDEEFF",
+        expectedOutput: "62F679BE2BF0D931641E039CA3401BB200657EA140655A44782747705D422FAD",
+        recipeConfig: [
+            {
+                op: "Payment Encrypt Data",
+                args: ["AES ECB", "00112233445566778899AABBCCDDEEFF", "", "", "Data", false]
+            }
+        ]
+    },
+    {
+        name: "Payment Decrypt Data: AES ECB",
+        input: "62F679BE2BF0D931641E039CA3401BB200657EA140655A44782747705D422FAD",
+        expectedOutput: "00112233445566778899AABBCCDDEEFF",
+        recipeConfig: [
+            {
+                op: "Payment Decrypt Data",
+                args: ["AES ECB", "00112233445566778899AABBCCDDEEFF", "", "", "Data", false]
+            }
+        ]
+    },
+    {
+        // CTR is a stream mode — no ISO 9797-1 padding appended.
+        name: "Payment Encrypt Data: AES CTR",
+        input: "00112233445566778899AABBCCDDEEFF",
+        expectedOutput: "FDF5D99D0E5C8657676E882D535E6DD4",
+        recipeConfig: [
+            {
+                op: "Payment Encrypt Data",
+                args: ["AES CTR", "00112233445566778899AABBCCDDEEFF", "00000000000000000000000000000000", "", "Data", false]
+            }
+        ]
+    },
+    {
+        name: "Payment Decrypt Data: AES CTR",
+        input: "FDF5D99D0E5C8657676E882D535E6DD4",
+        expectedOutput: "00112233445566778899AABBCCDDEEFF",
+        recipeConfig: [
+            {
+                op: "Payment Decrypt Data",
+                args: ["AES CTR", "00112233445566778899AABBCCDDEEFF", "00000000000000000000000000000000", "", "Data", false]
+            }
+        ]
+    },
+    {
+        // DUKPT TDES CBC: same BDK/KSN as TDES ECB test; CBC chains blocks using IV.
+        // ISO 9797-1 method-2 padding appends a second block to the output.
+        name: "Payment Encrypt Data: DUKPT TDES CBC (Data variant, counter 1)",
+        input: "0102030405060708",
+        expectedOutput: "92A5157E4607D1B0D64C005667C8C4DB",
+        recipeConfig: [
+            {
+                op: "Payment Encrypt Data",
+                args: ["DUKPT TDES CBC", "0123456789ABCDEFFEDCBA9876543210", "0000000000000000", "FFFF9876543210E00001", "Data", false]
+            }
+        ]
+    },
     {
         name: "MAC Generate: AES-CMAC",
         input: "1122334455667788",