exlim/cyberchef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename IBM 3624 ops to PIN-domain-first; use crypto.getRandomValues in PAN generator

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
J8k3 2026-05-19 09:34:51 -04:00
parent b724fc4b8c
commit 292f4afbb8
6 changed files with 22 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
PAYMENT_RECIPES.md
View File

@ -12,7 +12,7 @@ These recipe starters are for software-only payment-crypto emulation, inspection
All payment operation display names follow **Title Case** throughout. Acronyms (DUKPT, AES, EMV, MAC, PAN, PVV, KCV, ARQC, ARPC, TR-31, TR-34) are always upper-case. Brand names retain their canonical capitalisation (`payShield`).
Pattern: `[Domain Prefix] [Verb] [Qualifier]`
- Domain prefixes: EMV, DUKPT, PIN Block, PIN Data, PAN, Card Validation Data, VISA PVV, IBM 3624, AS2805, HSM, Payment, MAC, Key, TR-31, TR-34
- Domain prefixes: EMV, DUKPT, PIN Block, PIN Data, PIN IBM 3624, PAN, Card Validation Data, VISA PVV, AS2805, HSM, Payment, MAC, Key, TR-31, TR-34
- Verbs: Generate, Verify, Parse, Build, Translate, Derive, Calculate, Encrypt, Decrypt, Re-Encrypt
- The prefix comes first so operations sort and scan by topic in the UI list
- Only operations authored in this fork belong in the Payments category — do not add upstream CyberChef ops
@ -181,8 +181,8 @@ Important assumptions:
## 8) Issuer PIN Verification Helpers
Operations:
- `IBM 3624 Generate PIN Offset`
- `IBM 3624 Verify PIN`
- `PIN IBM 3624 Offset Generate`
- `PIN IBM 3624 Verify`
- `VISA PVV Generate`
- `VISA PVV Verify`
@ -315,8 +315,8 @@ Flow:
## G) IBM 3624 / PVV Verification
Operations:
- `IBM 3624 Generate PIN Offset`
- `IBM 3624 Verify PIN`
- `PIN IBM 3624 Offset Generate`
- `PIN IBM 3624 Verify`
- `VISA PVV Generate`
- `VISA PVV Verify`
@ -404,8 +404,8 @@ Release guidance: `Publish` = safe with normal guardrails; `Publish with guardra
| `EMV Generate ARPC` | Vendor-aligned | AWS `VerifyAuthRequestCryptogram` issuer flow | Publish with guardrails |
| `Card Validation Data Generate` | Vendor-aligned | AWS `GenerateCardValidationData` | Publish with guardrails |
| `Card Validation Data Verify` | Vendor-aligned | AWS `VerifyCardValidationData` | Publish with guardrails |
| `IBM 3624 Generate PIN Offset` | Vendor-aligned | AWS IBM 3624 PIN verification object | Publish with guardrails |
| `IBM 3624 Verify PIN` | Vendor-aligned | AWS IBM 3624 PIN verification object | Publish with guardrails |
| `PIN IBM 3624 Offset Generate` | Vendor-aligned | AWS IBM 3624 PIN verification object | Publish with guardrails |
| `PIN IBM 3624 Verify` | Vendor-aligned | AWS IBM 3624 PIN verification object | Publish with guardrails |
| `VISA PVV Generate` | Vendor-aligned | AWS VISA PIN verification object | Publish with guardrails |
| `VISA PVV Verify` | Vendor-aligned | AWS VISA PIN verification object | Publish with guardrails |
| `AS2805 Generate KEK Validation` | Test helper | AWS `GenerateAs2805KekValidation` | Publish with guardrails |

4
src/core/config/Categories.json
View File

@ -599,8 +599,8 @@
"EMV Verify MAC",
"HSM Parse Futurex Command",
"HSM Parse Thales Command",
"IBM 3624 Generate PIN Offset",
"IBM 3624 Verify PIN",
"PIN IBM 3624 Offset Generate",
"PIN IBM 3624 Verify",
"Key Generate",
"MAC Generate",
"MAC Verify",

4
src/core/lib/Pan.mjs
View File

@ -257,7 +257,9 @@ function finalizePan(body) {
* @returns {string}
*/
function fillerDigits(length) {
return Array.from({ length }, () => Math.floor(Math.random() * 10)).join("");
const buf = new Uint8Array(length);
crypto.getRandomValues(buf);
return Array.from(buf, b => b % 10).join("");
}
/**

2
src/core/operations/GenerateIBM3624PINOffset.mjs
View File

@ -16,7 +16,7 @@ class GenerateIBM3624PINOffset extends Operation {
constructor() {
super();
this.name = "IBM 3624 Generate PIN Offset";
this.name = "PIN IBM 3624 Offset Generate";
this.module = "Payment";
this.description = "Paste the clear PIN into the input field and generate the IBM 3624 offset used by issuer-side PIN verification.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, and pad character.<br><br><b>Validation:</b> Partially verified. This is a clear-key software implementation of the IBM 3624 PIN offset scheme rather than HSM-certified behavior.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, and pad character.<br><strong>Validation:</strong> clear-key IBM 3624 helper.";

4
src/core/operations/VerifyIBM3624PIN.mjs
View File

@ -16,9 +16,9 @@ class VerifyIBM3624PIN extends Operation {
constructor() {
super();
this.name = "IBM 3624 Verify PIN";
this.name = "PIN IBM 3624 Verify";
this.module = "Payment";
this.description = "Paste the stored PIN offset into the input field and verify it against a clear PIN.<br><br><b>Input:</b> stored IBM 3624 PIN offset (4 to 12 decimal digits).<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, pad character, and the clear PIN to verify.<br><br>This operation re-derives the offset from the supplied PIN and keying material and compares it to the input offset. Use this directly after <b>IBM 3624 Generate PIN Offset</b> in a recipe — the offset output flows naturally into this input.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key IBM 3624 helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
this.description = "Paste the stored PIN offset into the input field and verify it against a clear PIN.<br><br><b>Input:</b> stored IBM 3624 PIN offset (4 to 12 decimal digits).<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, pad character, and the clear PIN to verify.<br><br>This operation re-derives the offset from the supplied PIN and keying material and compares it to the input offset. Use this directly after <b>PIN IBM 3624 Offset Generate</b> in a recipe — the offset output flows naturally into this input.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key IBM 3624 helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
this.inlineHelp = "<strong>Input:</strong> stored IBM 3624 PIN offset.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, pad character, and the clear PIN to verify.<br><strong>Validation:</strong> clear-key IBM 3624 verification helper.";
this.testDataSamples = [
{

14
tests/operations/tests/Payment.mjs
View File

@ -849,7 +849,7 @@ TestRegister.addTests([
]
},
{
name: "IBM 3624 Generate PIN Offset: known sample",
name: "PIN IBM 3624 Offset Generate: known sample",
input: "1234",
expectedOutput: JSON.stringify({
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@ -865,13 +865,13 @@ TestRegister.addTests([
}, null, 4),
recipeConfig: [
{
op: "IBM 3624 Generate PIN Offset",
op: "PIN IBM 3624 Offset Generate",
args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", true]
}
]
},
{
name: "IBM 3624 Verify PIN: known sample",
name: "PIN IBM 3624 Verify: known sample",
input: "3207",
expectedOutput: JSON.stringify({
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@ -889,7 +889,7 @@ TestRegister.addTests([
}, null, 4),
recipeConfig: [
{
op: "IBM 3624 Verify PIN",
op: "PIN IBM 3624 Verify",
args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", "1234", true]
}
]
@ -1021,7 +1021,7 @@ TestRegister.addTests([
]
},
{
name: "Chain: IBM 3624 Generate PIN Offset → Verify PIN",
name: "Chain: PIN IBM 3624 Offset Generate → PIN Verify",
input: "1234",
expectedOutput: JSON.stringify({
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@ -1039,11 +1039,11 @@ TestRegister.addTests([
}, null, 4),
recipeConfig: [
{
op: "IBM 3624 Generate PIN Offset",
op: "PIN IBM 3624 Offset Generate",
args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", false]
},
{
op: "IBM 3624 Verify PIN",
op: "PIN IBM 3624 Verify",
args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", "1234", true]
}
]