Rename IBM 3624 ops to PIN-domain-first; use crypto.getRandomValues in PAN generator

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

PAYMENT_RECIPES.md

@@ -12,7 +12,7 @@ These recipe starters are for software-only payment-crypto emulation, inspection
 All payment operation display names follow **Title Case** throughout. Acronyms (DUKPT, AES, EMV, MAC, PAN, PVV, KCV, ARQC, ARPC, TR-31, TR-34) are always upper-case. Brand names retain their canonical capitalisation (`payShield`).
 
 Pattern: `[Domain Prefix] [Verb] [Qualifier]`
-- Domain prefixes: EMV, DUKPT, PIN Block, PIN Data, PAN, Card Validation Data, VISA PVV, IBM 3624, AS2805, HSM, Payment, MAC, Key, TR-31, TR-34
+- Domain prefixes: EMV, DUKPT, PIN Block, PIN Data, PIN IBM 3624, PAN, Card Validation Data, VISA PVV, AS2805, HSM, Payment, MAC, Key, TR-31, TR-34
 - Verbs: Generate, Verify, Parse, Build, Translate, Derive, Calculate, Encrypt, Decrypt, Re-Encrypt
 - The prefix comes first so operations sort and scan by topic in the UI list
 - Only operations authored in this fork belong in the Payments category — do not add upstream CyberChef ops
@@ -181,8 +181,8 @@ Important assumptions:
 ## 8) Issuer PIN Verification Helpers
 
 Operations:
-- `IBM 3624 Generate PIN Offset`
+- `PIN IBM 3624 Offset Generate`
-- `IBM 3624 Verify PIN`
+- `PIN IBM 3624 Verify`
 - `VISA PVV Generate`
 - `VISA PVV Verify`
 
@@ -315,8 +315,8 @@ Flow:
 ## G) IBM 3624 / PVV Verification
 
 Operations:
-- `IBM 3624 Generate PIN Offset`
+- `PIN IBM 3624 Offset Generate`
-- `IBM 3624 Verify PIN`
+- `PIN IBM 3624 Verify`
 - `VISA PVV Generate`
 - `VISA PVV Verify`
 
@@ -404,8 +404,8 @@ Release guidance: `Publish` = safe with normal guardrails; `Publish with guardra
 | `EMV Generate ARPC` | Vendor-aligned | AWS `VerifyAuthRequestCryptogram` issuer flow | Publish with guardrails |
 | `Card Validation Data Generate` | Vendor-aligned | AWS `GenerateCardValidationData` | Publish with guardrails |
 | `Card Validation Data Verify` | Vendor-aligned | AWS `VerifyCardValidationData` | Publish with guardrails |
-| `IBM 3624 Generate PIN Offset` | Vendor-aligned | AWS IBM 3624 PIN verification object | Publish with guardrails |
+| `PIN IBM 3624 Offset Generate` | Vendor-aligned | AWS IBM 3624 PIN verification object | Publish with guardrails |
-| `IBM 3624 Verify PIN` | Vendor-aligned | AWS IBM 3624 PIN verification object | Publish with guardrails |
+| `PIN IBM 3624 Verify` | Vendor-aligned | AWS IBM 3624 PIN verification object | Publish with guardrails |
 | `VISA PVV Generate` | Vendor-aligned | AWS VISA PIN verification object | Publish with guardrails |
 | `VISA PVV Verify` | Vendor-aligned | AWS VISA PIN verification object | Publish with guardrails |
 | `AS2805 Generate KEK Validation` | Test helper | AWS `GenerateAs2805KekValidation` | Publish with guardrails |

src/core/config/Categories.json

@@ -599,8 +599,8 @@
             "EMV Verify MAC",
             "HSM Parse Futurex Command",
             "HSM Parse Thales Command",
-            "IBM 3624 Generate PIN Offset",
+            "PIN IBM 3624 Offset Generate",
-            "IBM 3624 Verify PIN",
+            "PIN IBM 3624 Verify",
             "Key Generate",
             "MAC Generate",
             "MAC Verify",

src/core/lib/Pan.mjs

@@ -257,7 +257,9 @@ function finalizePan(body) {
  * @returns {string}
  */
 function fillerDigits(length) {
-    return Array.from({ length }, () => Math.floor(Math.random() * 10)).join("");
+    const buf = new Uint8Array(length);
+    crypto.getRandomValues(buf);
+    return Array.from(buf, b => b % 10).join("");
 }
 
 /**

src/core/operations/GenerateIBM3624PINOffset.mjs

@@ -16,7 +16,7 @@ class GenerateIBM3624PINOffset extends Operation {
     constructor() {
         super();
 
-        this.name = "IBM 3624 Generate PIN Offset";
+        this.name = "PIN IBM 3624 Offset Generate";
         this.module = "Payment";
         this.description = "Paste the clear PIN into the input field and generate the IBM 3624 offset used by issuer-side PIN verification.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, and pad character.<br><br><b>Validation:</b> Partially verified. This is a clear-key software implementation of the IBM 3624 PIN offset scheme rather than HSM-certified behavior.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
         this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, and pad character.<br><strong>Validation:</strong> clear-key IBM 3624 helper.";

src/core/operations/VerifyIBM3624PIN.mjs

@@ -16,9 +16,9 @@ class VerifyIBM3624PIN extends Operation {
     constructor() {
         super();
 
-        this.name = "IBM 3624 Verify PIN";
+        this.name = "PIN IBM 3624 Verify";
         this.module = "Payment";
-        this.description = "Paste the stored PIN offset into the input field and verify it against a clear PIN.<br><br><b>Input:</b> stored IBM 3624 PIN offset (4 to 12 decimal digits).<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, pad character, and the clear PIN to verify.<br><br>This operation re-derives the offset from the supplied PIN and keying material and compares it to the input offset. Use this directly after <b>IBM 3624 Generate PIN Offset</b> in a recipe — the offset output flows naturally into this input.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key IBM 3624 helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
+        this.description = "Paste the stored PIN offset into the input field and verify it against a clear PIN.<br><br><b>Input:</b> stored IBM 3624 PIN offset (4 to 12 decimal digits).<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, pad character, and the clear PIN to verify.<br><br>This operation re-derives the offset from the supplied PIN and keying material and compares it to the input offset. Use this directly after <b>PIN IBM 3624 Offset Generate</b> in a recipe — the offset output flows naturally into this input.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key IBM 3624 helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
         this.inlineHelp = "<strong>Input:</strong> stored IBM 3624 PIN offset.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, pad character, and the clear PIN to verify.<br><strong>Validation:</strong> clear-key IBM 3624 verification helper.";
         this.testDataSamples = [
             {

tests/operations/tests/Payment.mjs

@@ -849,7 +849,7 @@ TestRegister.addTests([
         ]
     },
     {
-        name: "IBM 3624 Generate PIN Offset: known sample",
+        name: "PIN IBM 3624 Offset Generate: known sample",
         input: "1234",
         expectedOutput: JSON.stringify({
             pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@@ -865,13 +865,13 @@ TestRegister.addTests([
         }, null, 4),
         recipeConfig: [
             {
-                op: "IBM 3624 Generate PIN Offset",
+                op: "PIN IBM 3624 Offset Generate",
                 args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", true]
             }
         ]
     },
     {
-        name: "IBM 3624 Verify PIN: known sample",
+        name: "PIN IBM 3624 Verify: known sample",
         input: "3207",
         expectedOutput: JSON.stringify({
             pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@@ -889,7 +889,7 @@ TestRegister.addTests([
         }, null, 4),
         recipeConfig: [
             {
-                op: "IBM 3624 Verify PIN",
+                op: "PIN IBM 3624 Verify",
                 args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", "1234", true]
             }
         ]
@@ -1021,7 +1021,7 @@ TestRegister.addTests([
         ]
     },
     {
-        name: "Chain: IBM 3624 Generate PIN Offset → Verify PIN",
+        name: "Chain: PIN IBM 3624 Offset Generate → PIN Verify",
         input: "1234",
         expectedOutput: JSON.stringify({
             pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@@ -1039,11 +1039,11 @@ TestRegister.addTests([
         }, null, 4),
         recipeConfig: [
             {
-                op: "IBM 3624 Generate PIN Offset",
+                op: "PIN IBM 3624 Offset Generate",
                 args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", false]
             },
             {
-                op: "IBM 3624 Verify PIN",
+                op: "PIN IBM 3624 Verify",
                 args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", "1234", true]
             }
         ]