exlim/cyberchef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename payment ops to domain-prefix-first; remove upstream ops from Payments category

Browse Source 
All 31 payment operation display names now lead with their domain prefix
(EMV, DUKPT, PIN Block, PAN, etc.) so they sort and scan by topic in the
UI list. 8 upstream CyberChef ops (AES Encrypt/Decrypt, Triple DES,
AES Key Wrap/Unwrap, HMAC, CMAC) removed from the Payments category.

Updated: op this.name fields, Categories.json, Payment.mjs tests,
PAYMENT_RECIPES.md, AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md, AGENTS.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
J8k3 2026-05-18 09:27:08 -04:00
parent 32ef373485
commit 634c835dfd
36 changed files with 281 additions and 287 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
AGENTS.md
View File

@ -32,7 +32,8 @@
When adding, renaming, or removing a payment operation: When adding, renaming, or removing a payment operation:
1. **Update `PAYMENT_RECIPES.md`** — add the operation to the correct numbered section and, if it introduces a new chaining pattern, add a lettered chaining pattern entry. Remove or mark deprecated any operations that are replaced. 1. **Update `PAYMENT_RECIPES.md`** — add the operation to the correct numbered section and, if it introduces a new chaining pattern, add a lettered chaining pattern entry. Remove or mark deprecated any operations that are replaced.
2. **Follow the naming convention** — all payment operation display names use Title Case. Acronyms (DUKPT, AES, EMV, MAC, PAN, TR-31, TR-34, KCV) stay upper-case. Brand names keep their canonical form (`payShield`). Pattern: `[Verb] [Optional Qualifier] [Noun]`. See the Naming Convention section in `PAYMENT_RECIPES.md`. 2. **Follow the naming convention** — all payment operation display names use Title Case. Acronyms (DUKPT, AES, EMV, MAC, PAN, TR-31, TR-34, KCV) stay upper-case. Brand names keep their canonical form (`payShield`). Pattern: `[Domain Prefix] [Verb] [Qualifier]` — the domain/protocol prefix comes first so operations sort and scan by topic in the UI list. Example: `EMV Verify MAC`, `DUKPT Derive TDES Key`, `PIN Block Parse`. See the Naming Convention section in `PAYMENT_RECIPES.md`.
5. **Only operations written for this fork belong in the Payments category** — do not add upstream CyberChef ops (AES Encrypt, HMAC, CMAC, Triple DES Encrypt, AES Key Wrap, etc.) even as convenience shortcuts. If an op wasn't authored here, it stays in its own upstream category only.
3. **Keep `this.name` and file name consistent** — the CyberChef UI shows `this.name`; the file name is the class name in PascalCase. Both should reflect the same intent. 3. **Keep `this.name` and file name consistent** — the CyberChef UI shows `this.name`; the file name is the class name in PascalCase. Both should reflect the same intent.
4. **Do not rename `this.name` without updating `PAYMENT_RECIPES.md`** — stale names in the doc are confusing and break recipe search. 4. **Do not rename `this.name` without updating `PAYMENT_RECIPES.md`** — stale names in the doc are confusing and break recipe search.

102
AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md
View File

@ -20,27 +20,27 @@ Coverage legend:
| AWS operation | Coverage | Use | | AWS operation | Coverage | Use |
| --- | --- | --- | | --- | --- | --- |
| `EncryptData` | `Direct` | `Encrypt Payment Data` | | `EncryptData` | `Direct` | `Payment Encrypt Data` |
| `DecryptData` | `Direct` | `Decrypt Payment Data` | | `DecryptData` | `Direct` | `Payment Decrypt Data` |
| `ReEncryptData` | `Direct` | `Re-Encrypt Payment Data` | | `ReEncryptData` | `Direct` | `Payment Re-Encrypt Data` |
| `GenerateMac` | `Direct` | `Generate Payment MAC` or `Generate EMV MAC` | | `GenerateMac` | `Direct` | `MAC Generate` or `EMV Generate MAC` |
| `VerifyMac` | `Direct` | `Verify Payment MAC` or `Verify EMV MAC` | | `VerifyMac` | `Direct` | `MAC Verify` or `EMV Verify MAC` |
| `VerifyAuthRequestCryptogram` | `Direct` | `Verify EMV ARQC` | | `VerifyAuthRequestCryptogram` | `Direct` | `EMV Verify ARQC` |
| `GenerateCardValidationData` | `Direct` | `Generate Card Validation Data` | | `GenerateCardValidationData` | `Direct` | `Card Validation Data Generate` |
| `VerifyCardValidationData` | `Direct` | `Verify Card Validation Data` | | `VerifyCardValidationData` | `Direct` | `Card Validation Data Verify` |
| `GeneratePinData` | `Direct` / `Chained` | `Generate Payment PIN Data`, `Generate IBM 3624 PIN Offset`, `Generate VISA PVV` | | `GeneratePinData` | `Direct` / `Chained` | `PIN Data Generate`, `IBM 3624 Generate PIN Offset`, `VISA PVV Generate` |
| `TranslatePinData` | `Direct` / `Chained` | `Translate Payment PIN Data` or clear PIN block plus cipher chaining | | `TranslatePinData` | `Direct` / `Chained` | `Translate Payment PIN Data` or clear PIN block plus cipher chaining |
| `VerifyPinData` | `Direct` | `Verify Payment PIN Data`, `Verify IBM 3624 PIN`, `Verify VISA PVV` | | `VerifyPinData` | `Direct` | `PIN Data Verify`, `IBM 3624 Verify PIN`, `VISA PVV Verify` |
| `TranslateKeyMaterial` | `Chained` | `Derive ECDH Key Material` + wrap/unwrap + TR-31/TR-34 helpers | | `TranslateKeyMaterial` | `Chained` | `Derive ECDH Key Material` + wrap/unwrap + TR-31/TR-34 helpers |
| `GenerateAs2805KekValidation` | `Emulated` | `Generate AS2805 KEK Validation` | | `GenerateAs2805KekValidation` | `Emulated` | `AS2805 Generate KEK Validation` |
| `GenerateMacEmvPinChange` | `Direct` / `Emulated` | `Generate EMV MAC For PIN Change` | | `GenerateMacEmvPinChange` | `Direct` / `Emulated` | `EMV Generate MAC (PIN Change)` |
## AWS `EncryptData` ## AWS `EncryptData`
Preferred operation: Preferred operation:
- `Encrypt Payment Data` - `Payment Encrypt Data`
Good chain: Good chain:
- `Derive DUKPT TDES Key` -> `Triple DES Encrypt` - `DUKPT Derive TDES Key` -> `Triple DES Encrypt`
- `Derive ECDH Key Material` -> KDF if needed -> `AES Encrypt` - `Derive ECDH Key Material` -> KDF if needed -> `AES Encrypt`
Notes: Notes:
@ -49,23 +49,23 @@ Notes:
## AWS `DecryptData` ## AWS `DecryptData`
Preferred operation: Preferred operation:
- `Decrypt Payment Data` - `Payment Decrypt Data`
Good chain: Good chain:
- `Derive DUKPT TDES Key` -> `Triple DES Decrypt` - `DUKPT Derive TDES Key` -> `Triple DES Decrypt`
- `Derive ECDH Key Material` -> KDF if needed -> `AES Decrypt` - `Derive ECDH Key Material` -> KDF if needed -> `AES Decrypt`
## AWS `ReEncryptData` ## AWS `ReEncryptData`
Preferred operation: Preferred operation:
- `Re-Encrypt Payment Data` - `Payment Re-Encrypt Data`
Good chain: Good chain:
- `Decrypt Payment Data` -> `Encrypt Payment Data` - `Payment Decrypt Data` -> `Payment Encrypt Data`
## AWS `GenerateMac` ## AWS `GenerateMac`
Preferred operations: Preferred operations:
- `Generate Payment MAC` - `MAC Generate`
- `Generate EMV MAC` - `EMV Generate MAC`
Current MAC coverage: Current MAC coverage:
- HMAC SHA-224 / 256 / 384 / 512 - HMAC SHA-224 / 256 / 384 / 512
@ -79,19 +79,19 @@ Current MAC coverage:
- DUKPT ISO 9797-1 Algorithm 3 - DUKPT ISO 9797-1 Algorithm 3
- EMV retail-MAC style generation with a provided session key - EMV retail-MAC style generation with a provided session key
Use `Generate EMV MAC` when: Use `EMV Generate MAC` when:
- the AWS flow is EMV-session-key based rather than a static or DUKPT MAC key - the AWS flow is EMV-session-key based rather than a static or DUKPT MAC key
## AWS `VerifyMac` ## AWS `VerifyMac`
Preferred operations: Preferred operations:
- `Verify Payment MAC` - `MAC Verify`
- `Verify EMV MAC` - `EMV Verify MAC`
Use the same method, padding rule, and key context as generation. Use the same method, padding rule, and key context as generation.
## AWS `VerifyAuthRequestCryptogram` ## AWS `VerifyAuthRequestCryptogram`
Preferred operation: Preferred operation:
- `Verify EMV ARQC` - `EMV Verify ARQC`
Good chain: Good chain:
- preassemble the ARQC input block - preassemble the ARQC input block
@ -103,7 +103,7 @@ Important assumption:
## AWS `GenerateCardValidationData` ## AWS `GenerateCardValidationData`
Preferred operation: Preferred operation:
- `Generate Card Validation Data` - `Card Validation Data Generate`
Profiles: Profiles:
- CVV / CVC - CVV / CVC
@ -112,31 +112,31 @@ Profiles:
## AWS `VerifyCardValidationData` ## AWS `VerifyCardValidationData`
Preferred operation: Preferred operation:
- `Verify Card Validation Data` - `Card Validation Data Verify`
## AWS `GeneratePinData` ## AWS `GeneratePinData`
Preferred operations: Preferred operations:
- `Generate Payment PIN Data` - `PIN Data Generate`
- `Generate IBM 3624 PIN Offset` - `IBM 3624 Generate PIN Offset`
- `Generate VISA PVV` - `VISA PVV Generate`
Use: Use:
- `Generate Payment PIN Data` for clear ISO format `0`, `1`, and `3` PIN blocks - `PIN Data Generate` for clear ISO format `0`, `1`, and `3` PIN blocks
- `Generate IBM 3624 PIN Offset` for issuer-host offset workflows - `IBM 3624 Generate PIN Offset` for issuer-host offset workflows
- `Generate VISA PVV` for PVV workflows - `VISA PVV Generate` for PVV workflows
Good chains: Good chains:
- clear PIN -> `Generate Payment PIN Data` -> `Encrypt Payment Data` - clear PIN -> `PIN Data Generate` -> `Payment Encrypt Data`
- clear PIN -> `Generate IBM 3624 PIN Offset` - clear PIN -> `IBM 3624 Generate PIN Offset`
- clear PIN -> `Generate VISA PVV` - clear PIN -> `VISA PVV Generate`
## AWS `TranslatePinData` ## AWS `TranslatePinData`
Preferred operation: Preferred operation:
- `Translate Payment PIN Data` - `Translate Payment PIN Data`
Good chains: Good chains:
- `Parse PIN Block` -> inspect -> `Translate PIN Block` - `PIN Block Parse` -> inspect -> `PIN Block Translate`
- `Decrypt Payment Data` -> `Translate Payment PIN Data` -> `Encrypt Payment Data` - `Payment Decrypt Data` -> `Translate Payment PIN Data` -> `Payment Encrypt Data`
Important assumption: Important assumption:
- the direct wrapper is for clear ISO PIN-block translation - the direct wrapper is for clear ISO PIN-block translation
@ -144,14 +144,14 @@ Important assumption:
## AWS `VerifyPinData` ## AWS `VerifyPinData`
Preferred operations: Preferred operations:
- `Verify Payment PIN Data` - `PIN Data Verify`
- `Verify IBM 3624 PIN` - `IBM 3624 Verify PIN`
- `Verify VISA PVV` - `VISA PVV Verify`
Use: Use:
- `Verify Payment PIN Data` for clear ISO PIN blocks - `PIN Data Verify` for clear ISO PIN blocks
- `Verify IBM 3624 PIN` for issuer offset checks - `IBM 3624 Verify PIN` for issuer offset checks
- `Verify VISA PVV` for PVV checks - `VISA PVV Verify` for PVV checks
## AWS `TranslateKeyMaterial` ## AWS `TranslateKeyMaterial`
Preferred chain: Preferred chain:
@ -166,7 +166,7 @@ Important assumption:
## AWS `GenerateAs2805KekValidation` ## AWS `GenerateAs2805KekValidation`
Preferred operation: Preferred operation:
- `Generate AS2805 KEK Validation` - `AS2805 Generate KEK Validation`
Important assumption: Important assumption:
- this is an explicit software emulation helper - this is an explicit software emulation helper
@ -174,7 +174,7 @@ Important assumption:
## AWS `GenerateMacEmvPinChange` ## AWS `GenerateMacEmvPinChange`
Preferred operation: Preferred operation:
- `Generate EMV MAC For PIN Change` - `EMV Generate MAC (PIN Change)`
Good chain: Good chain:
- build or obtain the encrypted target PIN block - build or obtain the encrypted target PIN block
@ -187,7 +187,7 @@ Important assumption:
## Common Chains ## Common Chains
## A) DUKPT Request MAC ## A) DUKPT Request MAC
- `Generate Payment MAC` - `MAC Generate`
Method: Method:
- `DUKPT MAC Request CMAC` - `DUKPT MAC Request CMAC`
@ -195,15 +195,15 @@ Method:
- or `DUKPT ISO 9797-1 Algorithm 3` - or `DUKPT ISO 9797-1 Algorithm 3`
## B) EMV Issuer Script MAC ## B) EMV Issuer Script MAC
- `Generate EMV MAC` - `EMV Generate MAC`
- `Verify EMV MAC` - `EMV Verify MAC`
## C) EMV PIN Change ## C) EMV PIN Change
- `Generate EMV MAC For PIN Change` - `EMV Generate MAC (PIN Change)`
## D) Clear PIN To Encrypted PIN Data ## D) Clear PIN To Encrypted PIN Data
- `Generate Payment PIN Data` - `PIN Data Generate`
- `Encrypt Payment Data` - `Payment Encrypt Data`
## E) ECDH-Based Key Translation Lab Flow ## E) ECDH-Based Key Translation Lab Flow
- `Derive ECDH Key Material` - `Derive ECDH Key Material`

173
PAYMENT_RECIPES.md
View File

@ -13,27 +13,28 @@ For validation posture, standards references, and release guardrails, see `PAYME
All payment operation display names follow **Title Case** throughout. Acronyms (DUKPT, AES, EMV, MAC, PAN, PVV, KCV, ARQC, ARPC, TR-31, TR-34) are always upper-case. Brand names retain their canonical capitalisation (`payShield`). All payment operation display names follow **Title Case** throughout. Acronyms (DUKPT, AES, EMV, MAC, PAN, PVV, KCV, ARQC, ARPC, TR-31, TR-34) are always upper-case. Brand names retain their canonical capitalisation (`payShield`).
Pattern: `[Verb] [Optional Qualifier] [Noun]` Pattern: `[Domain Prefix] [Verb] [Qualifier]`
- Domain prefixes: EMV, DUKPT, PIN Block, PIN Data, PAN, Card Validation Data, VISA PVV, IBM 3624, AS2805, HSM, Payment, MAC, Key, TR-31, TR-34
- Verbs: Generate, Verify, Parse, Build, Translate, Derive, Calculate, Encrypt, Decrypt, Re-Encrypt - Verbs: Generate, Verify, Parse, Build, Translate, Derive, Calculate, Encrypt, Decrypt, Re-Encrypt
- The prefix comes first so operations sort and scan by topic in the UI list
- Only operations authored in this fork belong in the Payments category — do not add upstream CyberChef ops
- When adding a new payment operation, follow this pattern and update this file. - When adding a new payment operation, follow this pattern and update this file.
## UI Arrangement ## UI Arrangement
The `Payments` category is arranged in this order: The `Payments` category is arranged in this order:
- payment-facing wrappers first - payment-facing wrappers (Payment Encrypt/Decrypt/Re-Encrypt) first
- EMV and card-validation flows next - MAC and EMV flows next
- PIN and issuer-verification helpers after that - PAN, card, and PIN flows after that
- key derivation, generation, KCV, and parser utilities next - key derivation, generation, KCV, and parser utilities next
- generic crypto primitives last for chaining - HSM command parsers last
That keeps common testing tasks near the top without hiding the underlying `HMAC`, `CMAC`, cipher, and key-wrap primitives that some chains still need.
## 1) Encrypt / Decrypt / Re-Encrypt Payment Data ## 1) Encrypt / Decrypt / Re-Encrypt Payment Data
Operations: Operations:
- `Encrypt Payment Data` - `Payment Encrypt Data`
- `Decrypt Payment Data` - `Payment Decrypt Data`
- `Re-Encrypt Payment Data` - `Payment Re-Encrypt Data`
Use this when: Use this when:
- you want payment-facing names for AES, TDES, or the implemented DUKPT-TDES profiles - you want payment-facing names for AES, TDES, or the implemented DUKPT-TDES profiles
@ -49,8 +50,8 @@ Important assumptions:
## 2) Generate / Verify Payment MAC ## 2) Generate / Verify Payment MAC
Operations: Operations:
- `Generate Payment MAC` - `MAC Generate`
- `Verify Payment MAC` - `MAC Verify`
Supported methods: Supported methods:
- `HMAC SHA-224` - `HMAC SHA-224`
@ -81,9 +82,9 @@ Important assumptions:
## 3) Generate / Verify EMV MAC ## 3) Generate / Verify EMV MAC
Operations: Operations:
- `Generate EMV MAC` - `EMV Generate MAC`
- `Verify EMV MAC` - `EMV Verify MAC`
- `Generate EMV MAC For PIN Change` - `EMV Generate MAC (PIN Change)`
Use this when: Use this when:
- you already have the EMV session integrity key - you already have the EMV session integrity key
@ -96,14 +97,14 @@ Input:
Important assumptions: Important assumptions:
- these operations do not derive EMV session keys - these operations do not derive EMV session keys
- they apply retail-MAC style EMV MAC generation with ISO9797 padding method 2 - they apply retail-MAC style EMV MAC generation with ISO9797 padding method 2
- `Generate EMV MAC For PIN Change` expects the new PIN block to already be encrypted before you call it - `EMV Generate MAC (PIN Change)` expects the new PIN block to already be encrypted before you call it
## 4) Generate / Verify EMV ARQC And ARPC ## 4) Generate / Verify EMV ARQC And ARPC
Operations: Operations:
- `Generate EMV ARQC` - `EMV Generate ARQC`
- `Verify EMV ARQC` - `EMV Verify ARQC`
- `Generate EMV ARPC` - `EMV Generate ARPC`
Use this when: Use this when:
- you already know the exact preassembled EMV data block - you already know the exact preassembled EMV data block
@ -119,10 +120,10 @@ Important assumptions:
## 5) Generate / Verify Card Validation Data ## 5) Generate / Verify Card Validation Data
Operations: Operations:
- `Generate Test PAN` - `PAN Generate`
- `Parse PAN` - `PAN Parse`
- `Generate Card Validation Data` - `Card Validation Data Generate`
- `Verify Card Validation Data` - `Card Validation Data Verify`
Profiles: Profiles:
- `CVV / CVC (use service code arg)` - `CVV / CVC (use service code arg)`
@ -136,31 +137,31 @@ Important assumptions:
- CVV2 forces service code `000` - CVV2 forces service code `000`
- iCVV forces service code `999` - iCVV forces service code `999`
- this is a clear-key software emulation of common card-validation flows - this is a clear-key software emulation of common card-validation flows
- `Parse PAN` now outputs `cardType`, `cardTypeConfidence`, and `majorIndustryIdentifierDescription` in addition to network and Luhn fields - `PAN Parse` now outputs `cardType`, `cardTypeConfidence`, and `majorIndustryIdentifierDescription` in addition to network and Luhn fields
Recommended chain: Recommended chain:
- `Generate Test PAN` -> `Parse PAN` -> `Generate Card Validation Data` - `PAN Generate` -> `PAN Parse` -> `Card Validation Data Generate`
Use `Generate Test PAN` when: Use `PAN Generate` when:
- you want a Visa, Mastercard, American Express, or Discover PAN to feed into later recipes - you want a Visa, Mastercard, American Express, or Discover PAN to feed into later recipes
Use `Parse PAN` when: Use `PAN Parse` when:
- you want to confirm network, card type hint, IIN, length, and Luhn validity before continuing - you want to confirm network, card type hint, IIN, length, and Luhn validity before continuing
## 6) Generate / Verify Payment PIN Data ## 6) Generate / Verify Payment PIN Data
Operations: Operations:
- `Generate Payment PIN Data` - `PIN Data Generate`
- `Verify Payment PIN Data` - `PIN Data Verify`
> **Note:** `Translate Payment PIN Data` is deprecated — use `Translate PIN Block` (section 7) instead. See issue #4. > **Note:** `Translate Payment PIN Data` is deprecated — use `PIN Block Translate` (section 7) instead. See issue #4.
Use this when: Use this when:
- you want AWS-style PIN-data naming for clear ISO 9564 block flows - you want AWS-style PIN-data naming for clear ISO 9564 block flows
Input: Input:
- `Generate Payment PIN Data`: clear PIN digits - `PIN Data Generate`: clear PIN digits
- `Verify Payment PIN Data`: clear PIN block hex - `PIN Data Verify`: clear PIN block hex
Important assumptions: Important assumptions:
- these wrappers currently cover clear ISO formats `0`, `1`, and `3` - these wrappers currently cover clear ISO formats `0`, `1`, and `3`
@ -169,17 +170,17 @@ Important assumptions:
## 7) Build / Parse / Translate PIN Block ## 7) Build / Parse / Translate PIN Block
Operations: Operations:
- `Build PIN Block` - `PIN Block Build`
- `Parse PIN Block` - `PIN Block Parse`
- `Translate PIN Block` - `PIN Block Translate`
Use this when: Use this when:
- you want the lower-level clear PIN-block tools directly - you want the lower-level clear PIN-block tools directly
Input: Input:
- `Build PIN Block`: clear PIN digits - `PIN Block Build`: clear PIN digits
- `Parse PIN Block`: clear PIN block hex - `PIN Block Parse`: clear PIN block hex
- `Translate PIN Block`: clear PIN block hex - `PIN Block Translate`: clear PIN block hex
Important assumptions: Important assumptions:
- current clear-block support is ISO formats `0`, `1`, and `3` - current clear-block support is ISO formats `0`, `1`, and `3`
@ -187,10 +188,10 @@ Important assumptions:
## 8) Issuer PIN Verification Helpers ## 8) Issuer PIN Verification Helpers
Operations: Operations:
- `Generate IBM 3624 PIN Offset` - `IBM 3624 Generate PIN Offset`
- `Verify IBM 3624 PIN` - `IBM 3624 Verify PIN`
- `Generate VISA PVV` - `VISA PVV Generate`
- `Verify VISA PVV` - `VISA PVV Verify`
Use this when: Use this when:
- you need issuer-side PIN verification artifacts rather than PIN blocks - you need issuer-side PIN verification artifacts rather than PIN blocks
@ -206,27 +207,27 @@ Important assumptions:
## 9) Key Derivation, Generation, And Validation ## 9) Key Derivation, Generation, And Validation
Operations: Operations:
- `Derive DUKPT TDES Key` — TDES DUKPT (10-byte KSN, IPEK-based) - `DUKPT Derive TDES Key` — TDES DUKPT (10-byte KSN, IPEK-based)
- `Derive DUKPT AES Key` — AES-128 DUKPT per ANSI X9.24-3 (12-byte KSN, IK-based) - `DUKPT Derive AES Key` — AES-128 DUKPT per ANSI X9.24-3 (12-byte KSN, IK-based)
- `Derive ECDH Key Material` - `Derive ECDH Key Material`
- `Generate Key` — random AES-128/192/256, TDES, or custom bytes; optional AES CMAC KCV - `Key Generate` — random AES-128/192/256, TDES, or custom bytes; optional AES CMAC KCV
- `Calculate Payment KCV` - `Payment Calculate KCV`
- `Generate AS2805 KEK Validation` - `AS2805 Generate KEK Validation`
Use this when: Use this when:
- you need transaction keys, shared secrets, random test keys, KCVs, or AS2805-style KEK-validation lab values - you need transaction keys, shared secrets, random test keys, KCVs, or AS2805-style KEK-validation lab values
Important assumptions: Important assumptions:
- `Derive DUKPT TDES Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT) - `DUKPT Derive TDES Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT)
- `Derive DUKPT AES Key` implements AES-128 via AES-CMAC per ANSI X9.24-3; AES-192/256 are not yet implemented - `DUKPT Derive AES Key` implements AES-128 via AES-CMAC per ANSI X9.24-3; AES-192/256 are not yet implemented
- `Generate Key` is for test use only — production keys must be generated in an approved HSM - `Key Generate` is for test use only — production keys must be generated in an approved HSM
- `Generate AS2805 KEK Validation` is an emulation-oriented helper and explicitly documents its simplifications in the operation comments - `AS2805 Generate KEK Validation` is an emulation-oriented helper and explicitly documents its simplifications in the operation comments
## 10) Key Container And HSM Command Inspection ## 10) Key Container And HSM Command Inspection
Operations: Operations:
- `Parse Thales payShield Command` - `HSM Parse Thales Command`
- `Parse Futurex Excrypt Command` - `HSM Parse Futurex Command`
- `Parse TR-31 Key Block` - `Parse TR-31 Key Block`
- `Parse TR-34 Key Transport` - `Parse TR-34 Key Transport`
@ -234,14 +235,14 @@ Use this when:
- you need to inspect vendor HSM command syntax, wrapped-key material, or transport frames during testing - you need to inspect vendor HSM command syntax, wrapped-key material, or transport frames during testing
Input: Input:
- `Parse Thales payShield Command`: raw legacy host command or response text - `HSM Parse Thales Command`: raw legacy host command or response text
- `Parse Futurex Excrypt Command`: raw bracketed Excrypt command or response text - `HSM Parse Futurex Command`: raw bracketed Excrypt command or response text
- `Parse TR-31 Key Block` / `Parse TR-34 Key Transport`: full payload as text or hex, depending on the operation comment - `Parse TR-31 Key Block` / `Parse TR-34 Key Transport`: full payload as text or hex, depending on the operation comment
Important assumptions: Important assumptions:
- the Thales and Futurex parsers currently focus on visible message syntax, delimiters, command identification, and field splitting rather than deep per-command semantic decoding - the Thales and Futurex parsers currently focus on visible message syntax, delimiters, command identification, and field splitting rather than deep per-command semantic decoding
- `Parse Thales payShield Command` expects the configured message-header length to be supplied in the op args - `HSM Parse Thales Command` expects the configured message-header length to be supplied in the op args
- `Parse Futurex Excrypt Command` treats Excrypt messages as delimiter-based tag/value fields and commonly uses the `AO` field as the command code - `HSM Parse Futurex Command` treats Excrypt messages as delimiter-based tag/value fields and commonly uses the `AO` field as the command code
- `Parse TR-31 Key Block` decodes all X9.143 header fields with descriptions and PCI compliance flags - `Parse TR-31 Key Block` decodes all X9.143 header fields with descriptions and PCI compliance flags
- `Parse TR-34 Key Transport` handles B0–B9 message types, error codes, and peeks at the outer ASN.1 SEQUENCE of the CMS envelope - `Parse TR-34 Key Transport` handles B0–B9 message types, error codes, and peeks at the outer ASN.1 SEQUENCE of the CMS envelope
@ -250,18 +251,18 @@ Important assumptions:
## A) TDES DUKPT MAC ## A) TDES DUKPT MAC
Operations: Operations:
- `Derive DUKPT TDES Key` - `DUKPT Derive TDES Key`
- `Generate Payment MAC` - `MAC Generate`
Flow: Flow:
- derive the transaction key first if you want to inspect it - derive the transaction key first if you want to inspect it
- or use a DUKPT MAC method directly in `Generate Payment MAC` - or use a DUKPT MAC method directly in `MAC Generate`
- use the same KSN and BDK on verify - use the same KSN and BDK on verify
## B) AES DUKPT Key Derivation ## B) AES DUKPT Key Derivation
Operations: Operations:
- `Derive DUKPT AES Key` - `DUKPT Derive AES Key`
Flow: Flow:
- provide the 16-byte BDK (or IK if you already have it) as hex input - provide the 16-byte BDK (or IK if you already have it) as hex input
@ -287,8 +288,8 @@ Important assumption:
## D) Clear PIN Block To Encrypted PIN Data ## D) Clear PIN Block To Encrypted PIN Data
Operations: Operations:
- `Generate Payment PIN Data` or `Build PIN Block` - `PIN Data Generate` or `PIN Block Build`
- `Encrypt Payment Data` - `Payment Encrypt Data`
Flow: Flow:
- generate the clear ISO PIN block first - generate the clear ISO PIN block first
@ -297,9 +298,9 @@ Flow:
## E) EMV ARQC / ARPC Review ## E) EMV ARQC / ARPC Review
Operations: Operations:
- `Generate EMV ARQC` - `EMV Generate ARQC`
- `Verify EMV ARQC` - `EMV Verify ARQC`
- `Generate EMV ARPC` - `EMV Generate ARPC`
Flow: Flow:
- build the exact request-data preimage outside the op - build the exact request-data preimage outside the op
@ -309,9 +310,9 @@ Flow:
## F) EMV Script MAC And PIN Change ## F) EMV Script MAC And PIN Change
Operations: Operations:
- `Generate EMV MAC` - `EMV Generate MAC`
- `Verify EMV MAC` - `EMV Verify MAC`
- `Generate EMV MAC For PIN Change` - `EMV Generate MAC (PIN Change)`
Flow: Flow:
- assemble the issuer-script APDU body as hex - assemble the issuer-script APDU body as hex
@ -321,10 +322,10 @@ Flow:
## G) IBM 3624 / PVV Verification ## G) IBM 3624 / PVV Verification
Operations: Operations:
- `Generate IBM 3624 PIN Offset` - `IBM 3624 Generate PIN Offset`
- `Verify IBM 3624 PIN` - `IBM 3624 Verify PIN`
- `Generate VISA PVV` - `VISA PVV Generate`
- `Verify VISA PVV` - `VISA PVV Verify`
Flow: Flow:
- keep the clear PIN in the input field - keep the clear PIN in the input field
@ -334,10 +335,10 @@ Flow:
## H) Brand Test Card Setup ## H) Brand Test Card Setup
Operations: Operations:
- `Generate Test PAN` - `PAN Generate`
- `Parse PAN` - `PAN Parse`
- `Generate Card Validation Data` - `Card Validation Data Generate`
- `Generate Payment PIN Data` - `PIN Data Generate`
Flow: Flow:
- generate a curated or locally generated brand-valid PAN - generate a curated or locally generated brand-valid PAN
@ -347,18 +348,18 @@ Flow:
## I) AS2805 KEK Validation ## I) AS2805 KEK Validation
Operations: Operations:
- `Generate AS2805 KEK Validation` - `AS2805 Generate KEK Validation`
- `Calculate Payment KCV` - `Payment Calculate KCV`
Flow: Flow:
- inspect the KEK with `Calculate Payment KCV` - inspect the KEK with `Payment Calculate KCV`
- generate request or response RandomKeySend / RandomKeyReceive values with the AS2805 helper - generate request or response RandomKeySend / RandomKeyReceive values with the AS2805 helper
## J) Vendor Command Triage ## J) Vendor Command Triage
Operations: Operations:
- `Parse Thales payShield Command` - `HSM Parse Thales Command`
- `Parse Futurex Excrypt Command` - `HSM Parse Futurex Command`
Flow: Flow:
- paste the raw host message first before trying to interpret the business meaning - paste the raw host message first before trying to interpret the business meaning
@ -368,10 +369,10 @@ Flow:
## K) Generate And Verify A Test Key ## K) Generate And Verify A Test Key
Operations: Operations:
- `Generate Key` - `Key Generate`
- `Calculate Payment KCV` - `Payment Calculate KCV`
Flow: Flow:
- use `Generate Key` with JSON output to get a random AES-128/192/256 or TDES key plus its CMAC KCV - use `Key Generate` with JSON output to get a random AES-128/192/256 or TDES key plus its CMAC KCV
- cross-check the KCV with `Calculate Payment KCV` if you need to verify against an HSM-generated value - cross-check the KCV with `Payment Calculate KCV` if you need to verify against an HSM-generated value
- pipe the hex key directly into derivation, MAC, or encryption recipes - pipe the hex key directly into derivation, MAC, or encryption recipes

72
src/core/config/Categories.json
View File

@ -586,47 +586,39 @@
{ {
"name": "Payments", "name": "Payments",
"ops": [ "ops": [
"Encrypt Payment Data", "Payment Encrypt Data",
"Decrypt Payment Data", "Payment Decrypt Data",
"Re-Encrypt Payment Data", "Payment Re-Encrypt Data",
"Generate Payment MAC", "MAC Generate",
"Verify Payment MAC", "MAC Verify",
"Generate EMV MAC", "EMV Generate MAC",
"Verify EMV MAC", "EMV Verify MAC",
"Generate EMV ARQC", "EMV Generate ARQC",
"Verify EMV ARQC", "EMV Verify ARQC",
"Generate EMV ARPC", "EMV Generate ARPC",
"Generate EMV MAC For PIN Change", "EMV Generate MAC (PIN Change)",
"Generate Test PAN", "PAN Generate",
"Parse PAN", "PAN Parse",
"Generate Card Validation Data", "Card Validation Data Generate",
"Verify Card Validation Data", "Card Validation Data Verify",
"Generate Payment PIN Data", "PIN Data Generate",
"Verify Payment PIN Data", "PIN Data Verify",
"Build PIN Block", "PIN Block Build",
"Parse PIN Block", "PIN Block Parse",
"Translate PIN Block", "PIN Block Translate",
"Generate IBM 3624 PIN Offset", "IBM 3624 Generate PIN Offset",
"Verify IBM 3624 PIN", "IBM 3624 Verify PIN",
"Generate VISA PVV", "VISA PVV Generate",
"Verify VISA PVV", "VISA PVV Verify",
"Derive DUKPT TDES Key", "DUKPT Derive TDES Key",
"Derive DUKPT AES Key", "DUKPT Derive AES Key",
"Generate Key", "Key Generate",
"Calculate Payment KCV", "Payment Calculate KCV",
"Generate AS2805 KEK Validation", "AS2805 Generate KEK Validation",
"Parse Thales payShield Command", "HSM Parse Thales Command",
"Parse Futurex Excrypt Command", "HSM Parse Futurex Command",
"Parse TR-31 Key Block", "Parse TR-31 Key Block",
"Parse TR-34 Key Transport", "Parse TR-34 Key Transport"
"HMAC",
"CMAC",
"AES Encrypt",
"AES Decrypt",
"Triple DES Encrypt",
"Triple DES Decrypt",
"AES Key Wrap",
"AES Key Unwrap"
] ]
}, },
{ {

2
src/core/operations/BuildPINBlock.mjs
View File

@ -17,7 +17,7 @@ class BuildPINBlock extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Build PIN Block"; this.name = "PIN Block Build";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the clear PIN into the input field and choose the ISO 9564 clear PIN block format to build.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> choose the target format, provide the PAN when required, and optionally randomize filler digits for formats 1 and 3.<br><br>This operation currently builds clear test PIN blocks for ISO formats 0, 1, and 3."; this.description = "Paste the clear PIN into the input field and choose the ISO 9564 clear PIN block format to build.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> choose the target format, provide the PAN when required, and optionally randomize filler digits for formats 1 and 3.<br><br>This operation currently builds clear test PIN blocks for ISO formats 0, 1, and 3.";
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> choose the format, add the PAN for formats 0 and 3, then decide whether format 1 or 3 filler digits should be randomized."; this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> choose the format, add the PAN for formats 0 and 3, then decide whether format 1 or 3 filler digits should be randomized.";

2
src/core/operations/CalculatePaymentKCV.mjs
View File

@ -20,7 +20,7 @@ class CalculatePaymentKCV extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Calculate Payment KCV"; this.name = "Payment Calculate KCV";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the key into the input field and choose how that key is encoded using <b>Key format</b>.<br><br>Use <b>Method</b> to choose the KCV style: TDES, AES-CMAC, AES-ECB, or HMAC.<br><br><b>Input:</b> raw key material such as hex, UTF-8, Latin1, or Base64.<br><b>Arguments:</b> select the key format, method, and output length in hex characters.<br><br>Returns an uppercase truncated hex KCV value."; this.description = "Paste the key into the input field and choose how that key is encoded using <b>Key format</b>.<br><br>Use <b>Method</b> to choose the KCV style: TDES, AES-CMAC, AES-ECB, or HMAC.<br><br><b>Input:</b> raw key material such as hex, UTF-8, Latin1, or Base64.<br><b>Arguments:</b> select the key format, method, and output length in hex characters.<br><br>Returns an uppercase truncated hex KCV value.";
this.inlineHelp = "<strong>Input:</strong> key material.<br><strong>Args:</strong> tell the op how the key is encoded, choose the KCV method, then set the output length."; this.inlineHelp = "<strong>Input:</strong> key material.<br><strong>Args:</strong> tell the op how the key is encoded, choose the KCV method, then set the output length.";

2
src/core/operations/DecryptPaymentData.mjs
View File

@ -16,7 +16,7 @@ class DecryptPaymentData extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Decrypt Payment Data"; this.name = "Payment Decrypt Data";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste ciphertext into the input field as hex and decrypt it using a payment-facing cipher wrapper.<br><br><b>Input:</b> ciphertext hex.<br><b>Arguments:</b> choose the cipher profile, provide a direct key or BDK, add IV where needed, and provide KSN plus DUKPT variant when using a DUKPT profile."; this.description = "Paste ciphertext into the input field as hex and decrypt it using a payment-facing cipher wrapper.<br><br><b>Input:</b> ciphertext hex.<br><b>Arguments:</b> choose the cipher profile, provide a direct key or BDK, add IV where needed, and provide KSN plus DUKPT variant when using a DUKPT profile.";
this.inlineHelp = "<strong>Input:</strong> ciphertext hex.<br><strong>Args:</strong> choose AES, TDES, or DUKPT-wrapped TDES, then provide key, IV, and optional KSN context."; this.inlineHelp = "<strong>Input:</strong> ciphertext hex.<br><strong>Args:</strong> choose AES, TDES, or DUKPT-wrapped TDES, then provide key, IV, and optional KSN context.";

2
src/core/operations/DeriveDUKPTAESKey.mjs
View File

@ -259,7 +259,7 @@ class DeriveDUKPTAESKey extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Derive DUKPT AES Key"; this.name = "DUKPT Derive AES Key";
this.module = "Payment"; this.module = "Payment";
this.description = [ this.description = [
"Derives AES DUKPT working keys per <b>ANSI X9.24-3</b> (AES-128).", "Derives AES DUKPT working keys per <b>ANSI X9.24-3</b> (AES-128).",

2
src/core/operations/DeriveDUKPTKey.mjs
View File

@ -196,7 +196,7 @@ class DeriveDUKPTKey extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Derive DUKPT TDES Key"; this.name = "DUKPT Derive TDES Key";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the Base Derivation Key (BDK) into the input field as a 16-byte hex value.<br><br>Put the 10-byte Key Serial Number in the <b>KSN</b> argument field.<br><br><b>Input:</b> BDK in hex.<br><b>Arguments:</b> choose whether to derive the IPEK or the transaction key, provide the KSN, choose the variant, and optionally return JSON.<br><br>This operation derives TDES DUKPT keys (ANSI X9.24 Part 1) in software for test and interoperability work. It uses a 16-byte BDK and a 10-byte KSN. AES DUKPT (ANSI X9.24 Part 3), which uses a 12-byte KSN and AES keys, is not implemented here."; this.description = "Paste the Base Derivation Key (BDK) into the input field as a 16-byte hex value.<br><br>Put the 10-byte Key Serial Number in the <b>KSN</b> argument field.<br><br><b>Input:</b> BDK in hex.<br><b>Arguments:</b> choose whether to derive the IPEK or the transaction key, provide the KSN, choose the variant, and optionally return JSON.<br><br>This operation derives TDES DUKPT keys (ANSI X9.24 Part 1) in software for test and interoperability work. It uses a 16-byte BDK and a 10-byte KSN. AES DUKPT (ANSI X9.24 Part 3), which uses a 12-byte KSN and AES keys, is not implemented here.";
this.inlineHelp = "<strong>Input:</strong> BDK hex.<br><strong>Args:</strong> add the KSN, choose IPEK or transaction-key derivation, then optionally apply a variant."; this.inlineHelp = "<strong>Input:</strong> BDK hex.<br><strong>Args:</strong> add the KSN, choose IPEK or transaction-key derivation, then optionally apply a variant.";

2
src/core/operations/EncryptPaymentData.mjs
View File

@ -16,7 +16,7 @@ class EncryptPaymentData extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Encrypt Payment Data"; this.name = "Payment Encrypt Data";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste plaintext into the input field as hex and encrypt it using a payment-facing cipher wrapper.<br><br><b>Input:</b> plaintext hex.<br><b>Arguments:</b> choose the cipher profile, provide a direct key or BDK, add IV where needed, and provide KSN plus DUKPT variant when using a DUKPT profile."; this.description = "Paste plaintext into the input field as hex and encrypt it using a payment-facing cipher wrapper.<br><br><b>Input:</b> plaintext hex.<br><b>Arguments:</b> choose the cipher profile, provide a direct key or BDK, add IV where needed, and provide KSN plus DUKPT variant when using a DUKPT profile.";
this.inlineHelp = "<strong>Input:</strong> plaintext hex.<br><strong>Args:</strong> choose AES, TDES, or DUKPT-wrapped TDES, then provide key, IV, and optional KSN context."; this.inlineHelp = "<strong>Input:</strong> plaintext hex.<br><strong>Args:</strong> choose AES, TDES, or DUKPT-wrapped TDES, then provide key, IV, and optional KSN context.";

2
src/core/operations/GenerateAS2805KEKValidation.mjs
View File

@ -47,7 +47,7 @@ class GenerateAS2805KEKValidation extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate AS2805 KEK Validation"; this.name = "AS2805 Generate KEK Validation";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the clear sending KEK into the input field as hex and generate an AS2805 KEK validation request or response.<br><br><b>Input:</b> clear KEK as 16-byte or 24-byte hex.<br><b>Arguments:</b> choose request or response mode, select the random-key length, choose the variant mask label, and optionally provide the incoming RandomKeySend value.<br><br><b>Validation:</b> Emulation helper. This software implementation returns <code>RandomKeyReceive</code> as the bytewise inverse of <code>RandomKeySend</code>, which is useful for lab testing but does not claim exact HSM-side AS2805 node-initialization behavior.<br><br><b>Security:</b> Clear KEKs in the recipe are test-use only."; this.description = "Paste the clear sending KEK into the input field as hex and generate an AS2805 KEK validation request or response.<br><br><b>Input:</b> clear KEK as 16-byte or 24-byte hex.<br><b>Arguments:</b> choose request or response mode, select the random-key length, choose the variant mask label, and optionally provide the incoming RandomKeySend value.<br><br><b>Validation:</b> Emulation helper. This software implementation returns <code>RandomKeyReceive</code> as the bytewise inverse of <code>RandomKeySend</code>, which is useful for lab testing but does not claim exact HSM-side AS2805 node-initialization behavior.<br><br><b>Security:</b> Clear KEKs in the recipe are test-use only.";
this.inlineHelp = "<strong>Input:</strong> clear KEK hex.<br><strong>Args:</strong> choose request or response mode and provide RandomKeySend for response mode.<br><strong>Validation:</strong> explicit emulation, not certified AS2805 behavior."; this.inlineHelp = "<strong>Input:</strong> clear KEK hex.<br><strong>Args:</strong> choose request or response mode and provide RandomKeySend for response mode.<br><strong>Validation:</strong> explicit emulation, not certified AS2805 behavior.";

2
src/core/operations/GenerateCardValidationData.mjs
View File

@ -17,7 +17,7 @@ class GenerateCardValidationData extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate Card Validation Data"; this.name = "Card Validation Data Generate";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the combined CVK pair into the input field as hex and generate a card-verification value for software testing.<br><br><b>Input:</b> combined CVK pair as 16-byte or 24-byte hex.<br><b>Arguments:</b> select whether you are generating CVV/CVC, CVV2/CVC2, or iCVV, then provide the PAN, expiry components, and service code details.<br><br>This implementation is intended for test harnesses and assumes the common CVV decimalization flow used by payment HSM integrations."; this.description = "Paste the combined CVK pair into the input field as hex and generate a card-verification value for software testing.<br><br><b>Input:</b> combined CVK pair as 16-byte or 24-byte hex.<br><b>Arguments:</b> select whether you are generating CVV/CVC, CVV2/CVC2, or iCVV, then provide the PAN, expiry components, and service code details.<br><br>This implementation is intended for test harnesses and assumes the common CVV decimalization flow used by payment HSM integrations.";
this.inlineHelp = "<strong>Input:</strong> combined CVK pair hex.<br><strong>Args:</strong> choose the validation-data profile, then provide PAN, expiry, and service-code inputs."; this.inlineHelp = "<strong>Input:</strong> combined CVK pair hex.<br><strong>Args:</strong> choose the validation-data profile, then provide PAN, expiry, and service-code inputs.";

2
src/core/operations/GenerateEMVARPC.mjs
View File

@ -17,7 +17,7 @@ class GenerateEMVARPC extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate EMV ARPC"; this.name = "EMV Generate ARPC";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the already-assembled EMV authorization-response input into the input field as hex and generate an AES-CMAC-based ARPC.<br><br><b>Input:</b> preassembled ARPC input data as hex.<br><b>Arguments:</b> provide the issuer session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV response profiles and does not derive issuer session keys or assemble response fields for you.<br><br><b>Session key derivation:</b> The issuer session key for ARPC generation is typically derived from the same issuer master key used for ARQC verification, using the same ATC-based derivation. The ARPC input data is assembled from the ARQC value and the Authorization Response Code (ARC). This operation expects both the session key and the preimage to be assembled before calling it.<br><br><b>Security:</b> Clear session keys are test-use only."; this.description = "Paste the already-assembled EMV authorization-response input into the input field as hex and generate an AES-CMAC-based ARPC.<br><br><b>Input:</b> preassembled ARPC input data as hex.<br><b>Arguments:</b> provide the issuer session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV response profiles and does not derive issuer session keys or assemble response fields for you.<br><br><b>Session key derivation:</b> The issuer session key for ARPC generation is typically derived from the same issuer master key used for ARQC verification, using the same ATC-based derivation. The ARPC input data is assembled from the ARQC value and the Authorization Response Code (ARC). This operation expects both the session key and the preimage to be assembled before calling it.<br><br><b>Security:</b> Clear session keys are test-use only.";
this.inlineHelp = "<strong>Input:</strong> preassembled ARPC data as hex.<br><strong>Args:</strong> provide the issuer AES session key and choose the truncated cryptogram length.<br><strong>Validation:</strong> supplied-key AES-CMAC response profile only."; this.inlineHelp = "<strong>Input:</strong> preassembled ARPC data as hex.<br><strong>Args:</strong> provide the issuer AES session key and choose the truncated cryptogram length.<br><strong>Validation:</strong> supplied-key AES-CMAC response profile only.";

2
src/core/operations/GenerateEMVARQC.mjs
View File

@ -17,7 +17,7 @@ class GenerateEMVARQC extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate EMV ARQC"; this.name = "EMV Generate ARQC";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and generate an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV profiles and does not derive EMV session keys or assemble CDOL data for you.<br><br><b>Session key derivation:</b> In a full EMV flow the session key is derived from the issuer master key using the Application Transaction Counter (ATC) and PAN sequence number. Visa and Amex use EMV Common Session Key Derivation (sometimes called Option A); Mastercard uses a different derivation (Option B). This operation expects you to supply the already-derived session key — use a separate key-derivation step before calling this operation if you need to reproduce a full end-to-end flow.<br><br><b>Security:</b> Clear session keys are test-use only."; this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and generate an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV profiles and does not derive EMV session keys or assemble CDOL data for you.<br><br><b>Session key derivation:</b> In a full EMV flow the session key is derived from the issuer master key using the Application Transaction Counter (ATC) and PAN sequence number. Visa and Amex use EMV Common Session Key Derivation (sometimes called Option A); Mastercard uses a different derivation (Option B). This operation expects you to supply the already-derived session key — use a separate key-derivation step before calling this operation if you need to reproduce a full end-to-end flow.<br><br><b>Security:</b> Clear session keys are test-use only.";
this.inlineHelp = "<strong>Input:</strong> preassembled ARQC data as hex.<br><strong>Args:</strong> provide the AES session key and choose the truncated cryptogram length.<br><strong>Validation:</strong> supplied-key AES-CMAC profile only."; this.inlineHelp = "<strong>Input:</strong> preassembled ARQC data as hex.<br><strong>Args:</strong> provide the AES session key and choose the truncated cryptogram length.<br><strong>Validation:</strong> supplied-key AES-CMAC profile only.";

2
src/core/operations/GenerateEMVMAC.mjs
View File

@ -16,7 +16,7 @@ class GenerateEMVMAC extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate EMV MAC"; this.name = "EMV Generate MAC";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the issuer-script or EMV command payload into the input field as hex and generate an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and choose how many leftmost MAC bytes to return.<br><br><b>Validation:</b> Partially verified. This implements a retail-MAC style EMV helper with a supplied session key, not full EMV session derivation or brand-specific issuer processing.<br><br><b>Key context:</b> In a full issuer implementation, the session integrity key used here corresponds to the secure-messaging integrity key (distinct from the confidentiality key used to encrypt data and the PIN encryption key used for PIN blocks). This operation accepts any key you supply and does not enforce that separation.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only."; this.description = "Paste the issuer-script or EMV command payload into the input field as hex and generate an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and choose how many leftmost MAC bytes to return.<br><br><b>Validation:</b> Partially verified. This implements a retail-MAC style EMV helper with a supplied session key, not full EMV session derivation or brand-specific issuer processing.<br><br><b>Key context:</b> In a full issuer implementation, the session integrity key used here corresponds to the secure-messaging integrity key (distinct from the confidentiality key used to encrypt data and the PIN encryption key used for PIN blocks). This operation accepts any key you supply and does not enforce that separation.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only.";
this.inlineHelp = "<strong>Input:</strong> issuer-script message data as hex.<br><strong>Args:</strong> provide the derived EMV session integrity key.<br><strong>Validation:</strong> supplied-key EMV MAC helper, not full EMV derivation."; this.inlineHelp = "<strong>Input:</strong> issuer-script message data as hex.<br><strong>Args:</strong> provide the derived EMV session integrity key.<br><strong>Validation:</strong> supplied-key EMV MAC helper, not full EMV derivation.";

2
src/core/operations/GenerateEMVMACForPINChange.mjs
View File

@ -16,7 +16,7 @@ class GenerateEMVMACForPINChange extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate EMV MAC For PIN Change"; this.name = "EMV Generate MAC (PIN Change)";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the issuer-script APDU command into the input field as hex and generate the MAC for an offline EMV PIN-change script.<br><br><b>Input:</b> issuer-script message data as hex.<br><b>Arguments:</b> provide the already-encrypted target PIN block in hex and the already-derived EMV session integrity key.<br><br><b>Validation:</b> Emulation helper. The new PIN block must already be encrypted, and this op appends it to the supplied message before applying the same supplied-key EMV MAC profile used elsewhere in this fork.<br><br><b>Key context:</b> In a full issuer implementation, a PIN-change script involves three distinct keys: a secure-messaging integrity key (for the MAC), a secure-messaging confidentiality key (for encrypting the script data), and a PIN encryption key (for the new PIN block). This operation accepts a single session integrity key and a pre-encrypted PIN block — it does not model the full three-key separation.<br><br><b>Security:</b> Test-only issuer-script assembly with clear session keys in the recipe."; this.description = "Paste the issuer-script APDU command into the input field as hex and generate the MAC for an offline EMV PIN-change script.<br><br><b>Input:</b> issuer-script message data as hex.<br><b>Arguments:</b> provide the already-encrypted target PIN block in hex and the already-derived EMV session integrity key.<br><br><b>Validation:</b> Emulation helper. The new PIN block must already be encrypted, and this op appends it to the supplied message before applying the same supplied-key EMV MAC profile used elsewhere in this fork.<br><br><b>Key context:</b> In a full issuer implementation, a PIN-change script involves three distinct keys: a secure-messaging integrity key (for the MAC), a secure-messaging confidentiality key (for encrypting the script data), and a PIN encryption key (for the new PIN block). This operation accepts a single session integrity key and a pre-encrypted PIN block — it does not model the full three-key separation.<br><br><b>Security:</b> Test-only issuer-script assembly with clear session keys in the recipe.";
this.inlineHelp = "<strong>Input:</strong> issuer-script APDU message as hex.<br><strong>Args:</strong> provide the encrypted target PIN block and derived EMV integrity key.<br><strong>Validation:</strong> emulation helper for PIN-change script MAC assembly."; this.inlineHelp = "<strong>Input:</strong> issuer-script APDU message as hex.<br><strong>Args:</strong> provide the encrypted target PIN block and derived EMV integrity key.<br><strong>Validation:</strong> emulation helper for PIN-change script MAC assembly.";

2
src/core/operations/GenerateIBM3624PINOffset.mjs
View File

@ -16,7 +16,7 @@ class GenerateIBM3624PINOffset extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate IBM 3624 PIN Offset"; this.name = "IBM 3624 Generate PIN Offset";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the clear PIN into the input field and generate the IBM 3624 offset used by issuer-side PIN verification.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, and pad character.<br><br><b>Validation:</b> Partially verified. This is a clear-key software implementation of the IBM 3624 PIN offset scheme rather than HSM-certified behavior.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only."; this.description = "Paste the clear PIN into the input field and generate the IBM 3624 offset used by issuer-side PIN verification.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, and pad character.<br><br><b>Validation:</b> Partially verified. This is a clear-key software implementation of the IBM 3624 PIN offset scheme rather than HSM-certified behavior.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, and pad character.<br><strong>Validation:</strong> clear-key IBM 3624 helper."; this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, and pad character.<br><strong>Validation:</strong> clear-key IBM 3624 helper.";

2
src/core/operations/GenerateKey.mjs
View File

@ -117,7 +117,7 @@ class GenerateKey extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate Key"; this.name = "Key Generate";
this.module = "Payment"; this.module = "Payment";
this.description = [ this.description = [
"Generates a cryptographically random payment key, IV, or custom-length byte string.", "Generates a cryptographically random payment key, IV, or custom-length byte string.",

2
src/core/operations/GeneratePaymentMAC.mjs
View File

@ -17,7 +17,7 @@ class GeneratePaymentMAC extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate Payment MAC"; this.name = "MAC Generate";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the message data into the input field and generate a payment-oriented MAC using one payment-facing operation.<br><br><b>Input:</b> message data in the selected input format.<br><b>Arguments:</b> choose the MAC method, provide either a direct key or a DUKPT BDK, optionally provide a KSN for DUKPT methods, choose the ISO9797 padding rule when applicable, and choose the truncation length.<br><br><b>Validation:</b> Mixed. HMAC/CMAC rely on established primitives. ISO9797 / AS2805 and DUKPT modes are software-emulation helpers that need to be interpreted in the scope called out by each method and key context.<br><br><b>Security:</b> Uses clear key material in the recipe. Do not paste production keys into shared or untrusted environments."; this.description = "Paste the message data into the input field and generate a payment-oriented MAC using one payment-facing operation.<br><br><b>Input:</b> message data in the selected input format.<br><b>Arguments:</b> choose the MAC method, provide either a direct key or a DUKPT BDK, optionally provide a KSN for DUKPT methods, choose the ISO9797 padding rule when applicable, and choose the truncation length.<br><br><b>Validation:</b> Mixed. HMAC/CMAC rely on established primitives. ISO9797 / AS2805 and DUKPT modes are software-emulation helpers that need to be interpreted in the scope called out by each method and key context.<br><br><b>Security:</b> Uses clear key material in the recipe. Do not paste production keys into shared or untrusted environments.";
this.inlineHelp = "<strong>Input:</strong> message data.<br><strong>Args:</strong> choose the payment MAC method, then provide either a direct key or a DUKPT BDK plus KSN.<br><strong>Validation:</strong> primitive-backed for HMAC/CMAC; broader payment semantics are profile-specific."; this.inlineHelp = "<strong>Input:</strong> message data.<br><strong>Args:</strong> choose the payment MAC method, then provide either a direct key or a DUKPT BDK plus KSN.<br><strong>Validation:</strong> primitive-backed for HMAC/CMAC; broader payment semantics are profile-specific.";

2
src/core/operations/GeneratePaymentPINData.mjs
View File

@ -16,7 +16,7 @@ class GeneratePaymentPINData extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate Payment PIN Data"; this.name = "PIN Data Generate";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the clear PIN into the input field and generate clear PIN-block test data.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> choose the PIN-block format, provide the PAN when required, and optionally return structured JSON.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only."; this.description = "Paste the clear PIN into the input field and generate clear PIN-block test data.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> choose the PIN-block format, provide the PAN when required, and optionally return structured JSON.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only.";
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> choose the block format and provide the PAN for PAN-bound formats.<br><strong>Validation:</strong> clear ISO formats 0, 1, and 3 only."; this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> choose the block format and provide the PAN for PAN-bound formats.<br><strong>Validation:</strong> clear ISO formats 0, 1, and 3 only.";

2
src/core/operations/GenerateTestPAN.mjs
View File

@ -16,7 +16,7 @@ class GenerateTestPAN extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate Test PAN"; this.name = "PAN Generate";
this.module = "Payment"; this.module = "Payment";
this.description = "Generate a brand-valid payment card number for test workflows.<br><br><b>Input:</b> ignored.<br><b>Arguments:</b> choose the payment network, decide whether to use a curated sample or a locally generated brand-valid PAN, and choose the target length when the network supports multiple lengths.<br><br><b>Validation:</b> Partially verified. Network classification and Luhn behavior are based on public numbering rules. Some curated samples are from public vendor docs, while generated samples are local deterministic test values rather than network-certified sandbox cards.<br><br><b>Security:</b> Test data only. Do not treat generated PANs as live accounts."; this.description = "Generate a brand-valid payment card number for test workflows.<br><br><b>Input:</b> ignored.<br><b>Arguments:</b> choose the payment network, decide whether to use a curated sample or a locally generated brand-valid PAN, and choose the target length when the network supports multiple lengths.<br><br><b>Validation:</b> Partially verified. Network classification and Luhn behavior are based on public numbering rules. Some curated samples are from public vendor docs, while generated samples are local deterministic test values rather than network-certified sandbox cards.<br><br><b>Security:</b> Test data only. Do not treat generated PANs as live accounts.";
this.inlineHelp = "<strong>Input:</strong> ignored.<br><strong>Args:</strong> choose the network, sample mode, and target length.<br><strong>Validation:</strong> public numbering rules + Luhn; not all curated samples are network-published official test cards."; this.inlineHelp = "<strong>Input:</strong> ignored.<br><strong>Args:</strong> choose the network, sample mode, and target length.<br><strong>Validation:</strong> public numbering rules + Luhn; not all curated samples are network-published official test cards.";

2
src/core/operations/GenerateVISAPVV.mjs
View File

@ -16,7 +16,7 @@ class GenerateVISAPVV extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Generate VISA PVV"; this.name = "VISA PVV Generate";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the clear PIN into the input field and generate a VISA PIN Verification Value (PVV).<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, PAN, and PVKI.<br><br><b>Validation:</b> Partially verified. This is a clear-key software implementation of the common VISA PVV assembly pattern, not an HSM-certified PVV service.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only."; this.description = "Paste the clear PIN into the input field and generate a VISA PIN Verification Value (PVV).<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, PAN, and PVKI.<br><br><b>Validation:</b> Partially verified. This is a clear-key software implementation of the common VISA PVV assembly pattern, not an HSM-certified PVV service.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, PAN, and PVKI.<br><strong>Validation:</strong> clear-key VISA PVV helper."; this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, PAN, and PVKI.<br><strong>Validation:</strong> clear-key VISA PVV helper.";

2
src/core/operations/ParseFuturexExcryptCommand.mjs
View File

@ -110,7 +110,7 @@ class ParseFuturexExcryptCommand extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Parse Futurex Excrypt Command"; this.name = "HSM Parse Futurex Command";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste a Futurex Excrypt command or response into the input field as text.<br><br><b>General syntax:</b> Excrypt messages are enclosed by opening and closing delimiters, typically <code>[</code> and <code>]</code>. Inside the message, fields are semicolon-delimited. Each field is a tag/value pair, for example <code>AOECHO</code> where <code>AO</code> is the tag and <code>ECHO</code> is the value. The command code is commonly carried in the <code>AO</code> field.<br><br><b>Input:</b> raw Excrypt message text.<br><br>This operation parses the visible Excrypt message syntax, extracts semicolon-delimited fields, splits fields into tag/value pairs, and resolves the <code>AO</code> command code to a known payment command name when available from the Futurex payment integration guide."; this.description = "Paste a Futurex Excrypt command or response into the input field as text.<br><br><b>General syntax:</b> Excrypt messages are enclosed by opening and closing delimiters, typically <code>[</code> and <code>]</code>. Inside the message, fields are semicolon-delimited. Each field is a tag/value pair, for example <code>AOECHO</code> where <code>AO</code> is the tag and <code>ECHO</code> is the value. The command code is commonly carried in the <code>AO</code> field.<br><br><b>Input:</b> raw Excrypt message text.<br><br>This operation parses the visible Excrypt message syntax, extracts semicolon-delimited fields, splits fields into tag/value pairs, and resolves the <code>AO</code> command code to a known payment command name when available from the Futurex payment integration guide.";
this.inlineHelp = "<strong>Syntax:</strong> <code>[tagvalue;tagvalue;...]</code> where fields are separated by semicolons and tags are typically two characters such as <code>AO</code>.<br><strong>Input:</strong> raw Futurex Excrypt message text."; this.inlineHelp = "<strong>Syntax:</strong> <code>[tagvalue;tagvalue;...]</code> where fields are separated by semicolons and tags are typically two characters such as <code>AO</code>.<br><strong>Input:</strong> raw Futurex Excrypt message text.";

2
src/core/operations/ParsePAN.mjs
View File

@ -16,7 +16,7 @@ class ParsePAN extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Parse PAN"; this.name = "PAN Parse";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste a payment card number into the input field and classify it by public network rules.<br><br><b>Input:</b> PAN digits.<br><b>Arguments:</b> none.<br><br><b>Validation:</b> Verified for Luhn behavior and public range matching used in this fork. Classification is limited to the implemented Visa, Mastercard, American Express, and Discover ranges.<br><br><b>Security:</b> PANs may still be sensitive. Use test data wherever possible."; this.description = "Paste a payment card number into the input field and classify it by public network rules.<br><br><b>Input:</b> PAN digits.<br><b>Arguments:</b> none.<br><br><b>Validation:</b> Verified for Luhn behavior and public range matching used in this fork. Classification is limited to the implemented Visa, Mastercard, American Express, and Discover ranges.<br><br><b>Security:</b> PANs may still be sensitive. Use test data wherever possible.";
this.inlineHelp = "<strong>Input:</strong> PAN digits only.<br><strong>Args:</strong> none.<br><strong>Validation:</strong> public range matching + Luhn."; this.inlineHelp = "<strong>Input:</strong> PAN digits only.<br><strong>Args:</strong> none.<br><strong>Validation:</strong> public range matching + Luhn.";

2
src/core/operations/ParsePINBlock.mjs
View File

@ -17,7 +17,7 @@ class ParsePINBlock extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Parse PIN Block"; this.name = "PIN Block Parse";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste a clear ISO 9564 PIN block into the input field as hex and decode it into its component fields.<br><br><b>Input:</b> 8-byte clear PIN block as hex.<br><b>Arguments:</b> choose the format and provide the PAN when the format binds to PAN data.<br><br>This operation currently parses clear test PIN blocks for ISO formats 0, 1, and 3."; this.description = "Paste a clear ISO 9564 PIN block into the input field as hex and decode it into its component fields.<br><br><b>Input:</b> 8-byte clear PIN block as hex.<br><b>Arguments:</b> choose the format and provide the PAN when the format binds to PAN data.<br><br>This operation currently parses clear test PIN blocks for ISO formats 0, 1, and 3.";
this.inlineHelp = "<strong>Input:</strong> clear PIN block hex.<br><strong>Args:</strong> choose the format and provide the PAN for formats 0 and 3 so the block can be decoded."; this.inlineHelp = "<strong>Input:</strong> clear PIN block hex.<br><strong>Args:</strong> choose the format and provide the PAN for formats 0 and 3 so the block can be decoded.";

2
src/core/operations/ParseThalesPayShieldCommand.mjs
View File

@ -255,7 +255,7 @@ class ParseThalesPayShieldCommand extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Parse Thales payShield Command"; this.name = "HSM Parse Thales Command";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste a Thales payShield 10K legacy host command or response into the input field as text.<br><br><b>General syntax:</b> optional <code>STX</code>, then <code>m</code> header characters, then a 2-character command or response code, then the command payload, then optionally an LMK suffix such as <code>%nn</code> or <code>~%nn</code>, then optionally <code>X'19'</code> and a message trailer, then optional <code>ETX</code>.<br><br><b>Input:</b> raw command text, optionally including STX/ETX framing, message header, X'19' end-message delimiter, and message trailer.<br><b>Arguments:</b> provide the configured message-header length.<br><br>This operation parses the visible payShield message syntax, identifies the two-character command/response code, resolves the manual command name when known, and extracts any trailing LMK identifier and message trailer."; this.description = "Paste a Thales payShield 10K legacy host command or response into the input field as text.<br><br><b>General syntax:</b> optional <code>STX</code>, then <code>m</code> header characters, then a 2-character command or response code, then the command payload, then optionally an LMK suffix such as <code>%nn</code> or <code>~%nn</code>, then optionally <code>X'19'</code> and a message trailer, then optional <code>ETX</code>.<br><br><b>Input:</b> raw command text, optionally including STX/ETX framing, message header, X'19' end-message delimiter, and message trailer.<br><b>Arguments:</b> provide the configured message-header length.<br><br>This operation parses the visible payShield message syntax, identifies the two-character command/response code, resolves the manual command name when known, and extracts any trailing LMK identifier and message trailer.";
this.inlineHelp = "<strong>Syntax:</strong> <code>[STX][header m][code 2][payload][~][%nn][EM trailer-delimiter][trailer][ETX]</code>.<br><strong>Input:</strong> raw payShield command or response text.<br><strong>Args:</strong> set the message-header length configured on the HSM link."; this.inlineHelp = "<strong>Syntax:</strong> <code>[STX][header m][code 2][payload][~][%nn][EM trailer-delimiter][trailer][ETX]</code>.<br><strong>Input:</strong> raw payShield command or response text.<br><strong>Args:</strong> set the message-header length configured on the HSM link.";

2
src/core/operations/ReEncryptPaymentData.mjs
View File

@ -16,7 +16,7 @@ class ReEncryptPaymentData extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Re-Encrypt Payment Data"; this.name = "Payment Re-Encrypt Data";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste ciphertext into the input field as hex, decrypt it under the source key context, then re-encrypt it under the target key context.<br><br><b>Input:</b> source ciphertext hex.<br><b>Arguments:</b> choose source and target profiles, provide the corresponding key or BDK material, add IVs, and supply KSN plus DUKPT variant when using DUKPT profiles."; this.description = "Paste ciphertext into the input field as hex, decrypt it under the source key context, then re-encrypt it under the target key context.<br><br><b>Input:</b> source ciphertext hex.<br><b>Arguments:</b> choose source and target profiles, provide the corresponding key or BDK material, add IVs, and supply KSN plus DUKPT variant when using DUKPT profiles.";
this.inlineHelp = "<strong>Input:</strong> source ciphertext hex.<br><strong>Args:</strong> define the source decrypt context, then the target encrypt context."; this.inlineHelp = "<strong>Input:</strong> source ciphertext hex.<br><strong>Args:</strong> define the source decrypt context, then the target encrypt context.";

2
src/core/operations/TranslatePINBlock.mjs
View File

@ -17,7 +17,7 @@ class TranslatePINBlock extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Translate PIN Block"; this.name = "PIN Block Translate";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste a clear ISO 9564 PIN block into the input field as hex and translate it between supported clear block formats.<br><br><b>Input:</b> 8-byte clear PIN block as hex.<br><b>Arguments:</b> choose the source and target formats, provide source and target PAN values when required, and optionally randomize target filler digits for formats 1 and 3.<br><br>This operation currently translates clear test PIN blocks for ISO formats 0, 1, and 3.<br><br><b>Important:</b> PIN translation must not change the cardholder PAN. Translating a PIN block from one PAN to a different PAN is prohibited by PCI PIN security requirements. Always supply the same PAN for both source and target when the formats require it."; this.description = "Paste a clear ISO 9564 PIN block into the input field as hex and translate it between supported clear block formats.<br><br><b>Input:</b> 8-byte clear PIN block as hex.<br><b>Arguments:</b> choose the source and target formats, provide source and target PAN values when required, and optionally randomize target filler digits for formats 1 and 3.<br><br>This operation currently translates clear test PIN blocks for ISO formats 0, 1, and 3.<br><br><b>Important:</b> PIN translation must not change the cardholder PAN. Translating a PIN block from one PAN to a different PAN is prohibited by PCI PIN security requirements. Always supply the same PAN for both source and target when the formats require it.";
this.inlineHelp = "<strong>Input:</strong> source clear PIN block hex.<br><strong>Args:</strong> choose source and target formats, then provide the source and target PAN values where the formats require them."; this.inlineHelp = "<strong>Input:</strong> source clear PIN block hex.<br><strong>Args:</strong> choose source and target formats, then provide the source and target PAN values where the formats require them.";

2
src/core/operations/VerifyCardValidationData.mjs
View File

@ -17,7 +17,7 @@ class VerifyCardValidationData extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Verify Card Validation Data"; this.name = "Card Validation Data Verify";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the combined CVK pair into the input field as hex and verify a CVV/CVC-style value for software testing.<br><br><b>Input:</b> combined CVK pair as 16-byte or 24-byte hex.<br><b>Arguments:</b> select the validation-data profile, provide the PAN and expiry components, then supply the expected validation data.<br><br>This operation recomputes the validation value using the same assumptions as the generate operation and reports whether the supplied value matches."; this.description = "Paste the combined CVK pair into the input field as hex and verify a CVV/CVC-style value for software testing.<br><br><b>Input:</b> combined CVK pair as 16-byte or 24-byte hex.<br><b>Arguments:</b> select the validation-data profile, provide the PAN and expiry components, then supply the expected validation data.<br><br>This operation recomputes the validation value using the same assumptions as the generate operation and reports whether the supplied value matches.";
this.inlineHelp = "<strong>Input:</strong> combined CVK pair hex.<br><strong>Args:</strong> provide PAN, expiry, service-code context, and the validation data to check."; this.inlineHelp = "<strong>Input:</strong> combined CVK pair hex.<br><strong>Args:</strong> provide PAN, expiry, service-code context, and the validation data to check.";

2
src/core/operations/VerifyEMVARQC.mjs
View File

@ -16,7 +16,7 @@ class VerifyEMVARQC extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Verify EMV ARQC"; this.name = "EMV Verify ARQC";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and verify an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key, cryptogram length, and expected ARQC hex value.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key AES-CMAC EMV profile as generation and does not claim full scheme-level ARQC validation semantics.<br><br><b>Session key derivation:</b> In a full EMV flow the session key is derived from the issuer master key using the Application Transaction Counter (ATC) and PAN sequence number. Visa and Amex use EMV Common Session Key Derivation (Option A); Mastercard uses a different derivation (Option B). This operation expects you to supply the already-derived session key.<br><br><b>Security:</b> Clear session keys are test-use only."; this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and verify an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key, cryptogram length, and expected ARQC hex value.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key AES-CMAC EMV profile as generation and does not claim full scheme-level ARQC validation semantics.<br><br><b>Session key derivation:</b> In a full EMV flow the session key is derived from the issuer master key using the Application Transaction Counter (ATC) and PAN sequence number. Visa and Amex use EMV Common Session Key Derivation (Option A); Mastercard uses a different derivation (Option B). This operation expects you to supply the already-derived session key.<br><br><b>Security:</b> Clear session keys are test-use only.";
this.inlineHelp = "<strong>Input:</strong> preassembled ARQC data as hex.<br><strong>Args:</strong> provide the AES session key and expected ARQC.<br><strong>Validation:</strong> same supplied-key EMV profile as generation."; this.inlineHelp = "<strong>Input:</strong> preassembled ARQC data as hex.<br><strong>Args:</strong> provide the AES session key and expected ARQC.<br><strong>Validation:</strong> same supplied-key EMV profile as generation.";

2
src/core/operations/VerifyEMVMAC.mjs
View File

@ -16,7 +16,7 @@ class VerifyEMVMAC extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Verify EMV MAC"; this.name = "EMV Verify MAC";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the issuer-script or EMV command payload into the input field as hex and verify an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and the expected MAC as hex.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key EMV MAC profile as the generate operation and does not claim full issuer-host or scheme-specific EMV verification semantics.<br><br><b>Key context:</b> In a full issuer implementation, the session integrity key used here corresponds to the secure-messaging integrity key (distinct from the confidentiality key used to encrypt data and the PIN encryption key used for PIN blocks). This operation accepts any key you supply and does not enforce that separation.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only."; this.description = "Paste the issuer-script or EMV command payload into the input field as hex and verify an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and the expected MAC as hex.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key EMV MAC profile as the generate operation and does not claim full issuer-host or scheme-specific EMV verification semantics.<br><br><b>Key context:</b> In a full issuer implementation, the session integrity key used here corresponds to the secure-messaging integrity key (distinct from the confidentiality key used to encrypt data and the PIN encryption key used for PIN blocks). This operation accepts any key you supply and does not enforce that separation.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only.";
this.inlineHelp = "<strong>Input:</strong> issuer-script message data as hex.<br><strong>Args:</strong> provide the derived EMV session key and expected MAC.<br><strong>Validation:</strong> same supplied-key EMV profile as generation."; this.inlineHelp = "<strong>Input:</strong> issuer-script message data as hex.<br><strong>Args:</strong> provide the derived EMV session key and expected MAC.<br><strong>Validation:</strong> same supplied-key EMV profile as generation.";

2
src/core/operations/VerifyIBM3624PIN.mjs
View File

@ -16,7 +16,7 @@ class VerifyIBM3624PIN extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Verify IBM 3624 PIN"; this.name = "IBM 3624 Verify PIN";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the clear PIN into the input field and verify it against an IBM 3624 offset.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, pad character, and expected offset.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key IBM 3624 helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only."; this.description = "Paste the clear PIN into the input field and verify it against an IBM 3624 offset.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, pad character, and expected offset.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key IBM 3624 helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, pad character, and expected offset.<br><strong>Validation:</strong> clear-key IBM 3624 verification helper."; this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, pad character, and expected offset.<br><strong>Validation:</strong> clear-key IBM 3624 verification helper.";

2
src/core/operations/VerifyPaymentMAC.mjs
View File

@ -17,7 +17,7 @@ class VerifyPaymentMAC extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Verify Payment MAC"; this.name = "MAC Verify";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the message data into the input field and verify a payment-oriented MAC using one payment-facing operation.<br><br><b>Input:</b> message data in the selected input format.<br><b>Arguments:</b> choose the MAC method, provide either a direct key or a DUKPT BDK, add the KSN for DUKPT methods, choose the ISO9797 padding rule when applicable, and supply the expected MAC as hex.<br><br><b>Validation:</b> Uses the same implementation paths and assumptions as the generate operation. Treat ISO9797, AS2805, DUKPT, and EMV-adjacent usage as profile-specific software verification rather than HSM certification.<br><br><b>Security:</b> Uses clear key material in the recipe."; this.description = "Paste the message data into the input field and verify a payment-oriented MAC using one payment-facing operation.<br><br><b>Input:</b> message data in the selected input format.<br><b>Arguments:</b> choose the MAC method, provide either a direct key or a DUKPT BDK, add the KSN for DUKPT methods, choose the ISO9797 padding rule when applicable, and supply the expected MAC as hex.<br><br><b>Validation:</b> Uses the same implementation paths and assumptions as the generate operation. Treat ISO9797, AS2805, DUKPT, and EMV-adjacent usage as profile-specific software verification rather than HSM certification.<br><br><b>Security:</b> Uses clear key material in the recipe.";
this.inlineHelp = "<strong>Input:</strong> message data.<br><strong>Args:</strong> choose the payment MAC method, provide the key context, then paste the expected MAC.<br><strong>Validation:</strong> same assumptions as generation."; this.inlineHelp = "<strong>Input:</strong> message data.<br><strong>Args:</strong> choose the payment MAC method, provide the key context, then paste the expected MAC.<br><strong>Validation:</strong> same assumptions as generation.";

2
src/core/operations/VerifyPaymentPINData.mjs
View File

@ -16,7 +16,7 @@ class VerifyPaymentPINData extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Verify Payment PIN Data"; this.name = "PIN Data Verify";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste a clear PIN block into the input field as hex and verify it against an expected PIN.<br><br><b>Input:</b> clear PIN block hex.<br><b>Arguments:</b> choose the format, provide the PAN when required, and supply the expected clear PIN.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only."; this.description = "Paste a clear PIN block into the input field as hex and verify it against an expected PIN.<br><br><b>Input:</b> clear PIN block hex.<br><b>Arguments:</b> choose the format, provide the PAN when required, and supply the expected clear PIN.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only.";
this.inlineHelp = "<strong>Input:</strong> clear PIN block hex.<br><strong>Args:</strong> define the PIN-block format, PAN context, and expected PIN.<br><strong>Validation:</strong> clear ISO formats 0, 1, and 3 only."; this.inlineHelp = "<strong>Input:</strong> clear PIN block hex.<br><strong>Args:</strong> define the PIN-block format, PAN context, and expected PIN.<br><strong>Validation:</strong> clear ISO formats 0, 1, and 3 only.";

2
src/core/operations/VerifyVISAPVV.mjs
View File

@ -16,7 +16,7 @@ class VerifyVISAPVV extends Operation {
constructor() { constructor() {
super(); super();
this.name = "Verify VISA PVV"; this.name = "VISA PVV Verify";
this.module = "Payment"; this.module = "Payment";
this.description = "Paste the clear PIN into the input field and verify it against a VISA PVV.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, PAN, PVKI, and expected PVV.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key VISA PVV helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only."; this.description = "Paste the clear PIN into the input field and verify it against a VISA PVV.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, PAN, PVKI, and expected PVV.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key VISA PVV helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, PAN, PVKI, and expected PVV.<br><strong>Validation:</strong> clear-key VISA PVV verification helper."; this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, PAN, PVKI, and expected PVV.<br><strong>Validation:</strong> clear-key VISA PVV verification helper.";

156
tests/operations/tests/Payment.mjs
View File

@ -53,7 +53,7 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Parse Thales payShield Command", op: "HSM Parse Thales Command",
args: [4] args: [4]
} }
] ]
@ -87,7 +87,7 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Parse Thales payShield Command", op: "HSM Parse Thales Command",
args: [0] args: [0]
} }
] ]
@ -130,7 +130,7 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Parse Futurex Excrypt Command", op: "HSM Parse Futurex Command",
args: [] args: []
} }
] ]
@ -175,7 +175,7 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Parse Futurex Excrypt Command", op: "HSM Parse Futurex Command",
args: [] args: []
} }
] ]
@ -261,84 +261,84 @@ TestRegister.addTests([
] ]
}, },
{ {
name: "Calculate Payment KCV: HMAC SHA-256", name: "Payment Calculate KCV: HMAC SHA-256",
input: "00112233445566778899AABBCCDDEEFF", input: "00112233445566778899AABBCCDDEEFF",
expectedOutput: "E8A065", expectedOutput: "E8A065",
recipeConfig: [ recipeConfig: [
{ {
op: "Calculate Payment KCV", op: "Payment Calculate KCV",
args: ["Hex", "HMAC SHA-256", 6] args: ["Hex", "HMAC SHA-256", 6]
} }
] ]
}, },
{ {
name: "Calculate Payment KCV: AES-CMAC empty", name: "Payment Calculate KCV: AES-CMAC empty",
input: "00112233445566778899AABBCCDDEEFF", input: "00112233445566778899AABBCCDDEEFF",
expectedOutput: "917737", expectedOutput: "917737",
recipeConfig: [ recipeConfig: [
{ {
op: "Calculate Payment KCV", op: "Payment Calculate KCV",
args: ["Hex", "AES-CMAC (Empty)", 6] args: ["Hex", "AES-CMAC (Empty)", 6]
} }
] ]
}, },
{ {
name: "Calculate Payment KCV: AES-CMAC zeros", name: "Payment Calculate KCV: AES-CMAC zeros",
input: "00112233445566778899AABBCCDDEEFF", input: "00112233445566778899AABBCCDDEEFF",
expectedOutput: "53E107", expectedOutput: "53E107",
recipeConfig: [ recipeConfig: [
{ {
op: "Calculate Payment KCV", op: "Payment Calculate KCV",
args: ["Hex", "AES-CMAC (Zeros)", 6] args: ["Hex", "AES-CMAC (Zeros)", 6]
} }
] ]
}, },
{ {
name: "Calculate Payment KCV: AES-CMAC ones", name: "Payment Calculate KCV: AES-CMAC ones",
input: "00112233445566778899AABBCCDDEEFF", input: "00112233445566778899AABBCCDDEEFF",
expectedOutput: "7B3046", expectedOutput: "7B3046",
recipeConfig: [ recipeConfig: [
{ {
op: "Calculate Payment KCV", op: "Payment Calculate KCV",
args: ["Hex", "AES-CMAC (Ones)", 6] args: ["Hex", "AES-CMAC (Ones)", 6]
} }
] ]
}, },
{ {
name: "Calculate Payment KCV: AES-ECB zeros", name: "Payment Calculate KCV: AES-ECB zeros",
input: "00112233445566778899AABBCCDDEEFF", input: "00112233445566778899AABBCCDDEEFF",
expectedOutput: "FDE4FB", expectedOutput: "FDE4FB",
recipeConfig: [ recipeConfig: [
{ {
op: "Calculate Payment KCV", op: "Payment Calculate KCV",
args: ["Hex", "AES-ECB (Zeros)", 6] args: ["Hex", "AES-ECB (Zeros)", 6]
} }
] ]
}, },
{ {
name: "Derive DUKPT TDES Key: known IPEK vector", name: "DUKPT Derive TDES Key: known IPEK vector",
input: "0123456789ABCDEFFEDCBA9876543210", input: "0123456789ABCDEFFEDCBA9876543210",
expectedOutput: "6AC292FAA1315B4D858AB3A3D7D5933A", expectedOutput: "6AC292FAA1315B4D858AB3A3D7D5933A",
recipeConfig: [ recipeConfig: [
{ {
op: "Derive DUKPT TDES Key", op: "DUKPT Derive TDES Key",
args: ["Derive IPEK", "FFFF9876543210E00008", "None", false] args: ["Derive IPEK", "FFFF9876543210E00008", "None", false]
} }
] ]
}, },
{ {
name: "Build PIN Block: ISO Format 0", name: "PIN Block Build: ISO Format 0",
input: "1234", input: "1234",
expectedOutput: "041215FEDCBA9876", expectedOutput: "041215FEDCBA9876",
recipeConfig: [ recipeConfig: [
{ {
op: "Build PIN Block", op: "PIN Block Build",
args: ["ISO Format 0", "5432101234567890", false] args: ["ISO Format 0", "5432101234567890", false]
} }
] ]
}, },
{ {
name: "Parse PIN Block: ISO Format 0", name: "PIN Block Parse: ISO Format 0",
input: "041215FEDCBA9876", input: "041215FEDCBA9876",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
format: "ISO Format 0", format: "ISO Format 0",
@ -351,13 +351,13 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Parse PIN Block", op: "PIN Block Parse",
args: ["ISO Format 0", "5432101234567890"] args: ["ISO Format 0", "5432101234567890"]
} }
] ]
}, },
{ {
name: "Translate PIN Block: ISO Format 0 to ISO Format 1", name: "PIN Block Translate: ISO Format 0 to ISO Format 1",
input: "041215FEDCBA9876", input: "041215FEDCBA9876",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
source: { source: {
@ -376,24 +376,24 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Translate PIN Block", op: "PIN Block Translate",
args: ["ISO Format 0", "5432101234567890", "ISO Format 1", "", false] args: ["ISO Format 0", "5432101234567890", "ISO Format 1", "", false]
} }
] ]
}, },
{ {
name: "Generate Card Validation Data: known CVV2 sample", name: "Card Validation Data Generate: known CVV2 sample",
input: "0123456789ABCDEFFEDCBA9876543210", input: "0123456789ABCDEFFEDCBA9876543210",
expectedOutput: "221", expectedOutput: "221",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Card Validation Data", op: "Card Validation Data Generate",
args: ["CVV2 / CVC2 (force 000)", "4123456789012345", "02", "25", "MMYY", "101", 3, false] args: ["CVV2 / CVC2 (force 000)", "4123456789012345", "02", "25", "MMYY", "101", 3, false]
} }
] ]
}, },
{ {
name: "Generate Test PAN: Visa curated sample", name: "PAN Generate: Visa curated sample",
input: "", input: "",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
brand: "Visa", brand: "Visa",
@ -415,24 +415,24 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Test PAN", op: "PAN Generate",
args: ["Visa", "Curated sample", 16, true] args: ["Visa", "Curated sample", 16, true]
} }
] ]
}, },
{ {
name: "Generate Test PAN: American Express curated sample", name: "PAN Generate: American Express curated sample",
input: "", input: "",
expectedOutput: "371449635398431", expectedOutput: "371449635398431",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Test PAN", op: "PAN Generate",
args: ["American Express", "Curated sample", 15, false] args: ["American Express", "Curated sample", 15, false]
} }
] ]
}, },
{ {
name: "Parse PAN: Discover sample", name: "PAN Parse: Discover sample",
input: "6011000991543426", input: "6011000991543426",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
pan: "6011000991543426", pan: "6011000991543426",
@ -454,13 +454,13 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Parse PAN", op: "PAN Parse",
args: [] args: []
} }
] ]
}, },
{ {
name: "Verify Card Validation Data: known CVV2 sample", name: "Card Validation Data Verify: known CVV2 sample",
input: "0123456789ABCDEFFEDCBA9876543210", input: "0123456789ABCDEFFEDCBA9876543210",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
profile: "CVV2 / CVC2 (force 000)", profile: "CVV2 / CVC2 (force 000)",
@ -478,35 +478,35 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Verify Card Validation Data", op: "Card Validation Data Verify",
args: ["CVV2 / CVC2 (force 000)", "4123456789012345", "02", "25", "MMYY", "101", "221"] args: ["CVV2 / CVC2 (force 000)", "4123456789012345", "02", "25", "MMYY", "101", "221"]
} }
] ]
}, },
{ {
name: "Generate EMV ARQC: AES-CMAC profile", name: "EMV Generate ARQC: AES-CMAC profile",
input: "000102030405060708090A0B0C0D0E0F", input: "000102030405060708090A0B0C0D0E0F",
expectedOutput: "C1F732B52FB20CAA", expectedOutput: "C1F732B52FB20CAA",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate EMV ARQC", op: "EMV Generate ARQC",
args: ["00112233445566778899AABBCCDDEEFF", 8, false] args: ["00112233445566778899AABBCCDDEEFF", 8, false]
} }
] ]
}, },
{ {
name: "Generate EMV ARPC: AES-CMAC profile", name: "EMV Generate ARPC: AES-CMAC profile",
input: "11223344556677889900AABBCCDDEEFF", input: "11223344556677889900AABBCCDDEEFF",
expectedOutput: "312442B1A4D64F94", expectedOutput: "312442B1A4D64F94",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate EMV ARPC", op: "EMV Generate ARPC",
args: ["00112233445566778899AABBCCDDEEFF", 8, false] args: ["00112233445566778899AABBCCDDEEFF", 8, false]
} }
] ]
}, },
{ {
name: "Verify EMV ARQC: AES-CMAC profile", name: "EMV Verify ARQC: AES-CMAC profile",
input: "000102030405060708090A0B0C0D0E0F", input: "000102030405060708090A0B0C0D0E0F",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
inputHex: "000102030405060708090A0B0C0D0E0F", inputHex: "000102030405060708090A0B0C0D0E0F",
@ -518,112 +518,112 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Verify EMV ARQC", op: "EMV Verify ARQC",
args: ["00112233445566778899AABBCCDDEEFF", 8, "C1F732B52FB20CAA"] args: ["00112233445566778899AABBCCDDEEFF", 8, "C1F732B52FB20CAA"]
} }
] ]
}, },
{ {
name: "Encrypt Payment Data: AES CBC", name: "Payment Encrypt Data: AES CBC",
input: "00112233445566778899AABBCCDDEEFF", input: "00112233445566778899AABBCCDDEEFF",
expectedOutput: "67423557CA0509243B9EE04A5DA3448AA397F6D29B5C8BCE065D9CDC936B7F9B", expectedOutput: "67423557CA0509243B9EE04A5DA3448AA397F6D29B5C8BCE065D9CDC936B7F9B",
recipeConfig: [ recipeConfig: [
{ {
op: "Encrypt Payment Data", op: "Payment Encrypt Data",
args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", false] args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", false]
} }
] ]
}, },
{ {
name: "Decrypt Payment Data: AES CBC", name: "Payment Decrypt Data: AES CBC",
input: "67423557CA0509243B9EE04A5DA3448AA397F6D29B5C8BCE065D9CDC936B7F9B", input: "67423557CA0509243B9EE04A5DA3448AA397F6D29B5C8BCE065D9CDC936B7F9B",
expectedOutput: "00112233445566778899AABBCCDDEEFF", expectedOutput: "00112233445566778899AABBCCDDEEFF",
recipeConfig: [ recipeConfig: [
{ {
op: "Decrypt Payment Data", op: "Payment Decrypt Data",
args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", false] args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", false]
} }
] ]
}, },
{ {
name: "Re-Encrypt Payment Data: AES CBC to TDES CBC", name: "Payment Re-Encrypt Data: AES CBC to TDES CBC",
input: "67423557CA0509243B9EE04A5DA3448AA397F6D29B5C8BCE065D9CDC936B7F9B", input: "67423557CA0509243B9EE04A5DA3448AA397F6D29B5C8BCE065D9CDC936B7F9B",
expectedOutput: "C47BC6E91A9D566F649D750BCE1CE9889FB5AE1489A16692", expectedOutput: "C47BC6E91A9D566F649D750BCE1CE9889FB5AE1489A16692",
recipeConfig: [ recipeConfig: [
{ {
op: "Re-Encrypt Payment Data", op: "Payment Re-Encrypt Data",
args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", "TDES CBC", "0123456789ABCDEFFEDCBA9876543210", "1234567890ABCDEF", "", "Data", false] args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", "TDES CBC", "0123456789ABCDEFFEDCBA9876543210", "1234567890ABCDEF", "", "Data", false]
} }
] ]
}, },
{ {
name: "Generate Payment MAC: AES-CMAC", name: "MAC Generate: AES-CMAC",
input: "1122334455667788", input: "1122334455667788",
expectedOutput: "339AF1AD1650E908", expectedOutput: "339AF1AD1650E908",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Payment MAC", op: "MAC Generate",
args: ["Hex", "AES-CMAC", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", 8, false] args: ["Hex", "AES-CMAC", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", 8, false]
} }
] ]
}, },
{ {
name: "Generate Payment MAC: HMAC SHA-256", name: "MAC Generate: HMAC SHA-256",
input: "1122334455667788", input: "1122334455667788",
expectedOutput: "9300E1D36DD30415", expectedOutput: "9300E1D36DD30415",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Payment MAC", op: "MAC Generate",
args: ["Hex", "HMAC SHA-256", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", 8, false] args: ["Hex", "HMAC SHA-256", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", 8, false]
} }
] ]
}, },
{ {
name: "Generate Payment MAC: DUKPT MAC Request CMAC", name: "MAC Generate: DUKPT MAC Request CMAC",
input: "1122334455667788", input: "1122334455667788",
expectedOutput: "3616961727FE155D", expectedOutput: "3616961727FE155D",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Payment MAC", op: "MAC Generate",
args: ["Hex", "DUKPT MAC Request CMAC", "0123456789ABCDEFFEDCBA9876543210", "Hex", "FFFF9876543210E00008", "Method 1", 8, false] args: ["Hex", "DUKPT MAC Request CMAC", "0123456789ABCDEFFEDCBA9876543210", "Hex", "FFFF9876543210E00008", "Method 1", 8, false]
} }
] ]
}, },
{ {
name: "Generate Payment MAC: ISO 9797-1 Algorithm 1", name: "MAC Generate: ISO 9797-1 Algorithm 1",
input: "1122334455667788", input: "1122334455667788",
expectedOutput: "0C949BCDEF6FDF1D", expectedOutput: "0C949BCDEF6FDF1D",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Payment MAC", op: "MAC Generate",
args: ["Hex", "ISO 9797-1 Algorithm 1", "0123456789ABCDEFFEDCBA9876543210", "Hex", "", "Method 1", 8, false] args: ["Hex", "ISO 9797-1 Algorithm 1", "0123456789ABCDEFFEDCBA9876543210", "Hex", "", "Method 1", 8, false]
} }
] ]
}, },
{ {
name: "Generate Payment MAC: ISO 9797-1 Algorithm 3", name: "MAC Generate: ISO 9797-1 Algorithm 3",
input: "1122334455667788", input: "1122334455667788",
expectedOutput: "7E2AEA5CF35FDC0E", expectedOutput: "7E2AEA5CF35FDC0E",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Payment MAC", op: "MAC Generate",
args: ["Hex", "ISO 9797-1 Algorithm 3", "0123456789ABCDEFFEDCBA9876543210", "Hex", "", "Method 2", 8, false] args: ["Hex", "ISO 9797-1 Algorithm 3", "0123456789ABCDEFFEDCBA9876543210", "Hex", "", "Method 2", 8, false]
} }
] ]
}, },
{ {
name: "Generate Payment MAC: AS2805-4.1", name: "MAC Generate: AS2805-4.1",
input: "1122334455667788", input: "1122334455667788",
expectedOutput: "3EB3B72576BBBE83", expectedOutput: "3EB3B72576BBBE83",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Payment MAC", op: "MAC Generate",
args: ["Hex", "AS2805-4.1", "0123456789ABCDEFFEDCBA9876543210", "Hex", "", "Method 1", 8, false] args: ["Hex", "AS2805-4.1", "0123456789ABCDEFFEDCBA9876543210", "Hex", "", "Method 1", 8, false]
} }
] ]
}, },
{ {
name: "Verify Payment MAC: AES-CMAC", name: "MAC Verify: AES-CMAC",
input: "1122334455667788", input: "1122334455667788",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
method: "AES-CMAC", method: "AES-CMAC",
@ -639,24 +639,24 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Verify Payment MAC", op: "MAC Verify",
args: ["Hex", "AES-CMAC", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", "339AF1AD1650E908", true] args: ["Hex", "AES-CMAC", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", "339AF1AD1650E908", true]
} }
] ]
}, },
{ {
name: "Generate EMV MAC: issuer script sample", name: "EMV Generate MAC: issuer script sample",
input: "8424000008999E57FD0F47CACE0007", input: "8424000008999E57FD0F47CACE0007",
expectedOutput: "22CB48394DFD1977", expectedOutput: "22CB48394DFD1977",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate EMV MAC", op: "EMV Generate MAC",
args: ["0123456789ABCDEFFEDCBA9876543210", 8, false] args: ["0123456789ABCDEFFEDCBA9876543210", 8, false]
} }
] ]
}, },
{ {
name: "Verify EMV MAC: issuer script sample", name: "EMV Verify MAC: issuer script sample",
input: "8424000008999E57FD0F47CACE0007", input: "8424000008999E57FD0F47CACE0007",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
algorithm: "EMV MAC", algorithm: "EMV MAC",
@ -669,35 +669,35 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Verify EMV MAC", op: "EMV Verify MAC",
args: ["0123456789ABCDEFFEDCBA9876543210", "22CB48394DFD1977", true] args: ["0123456789ABCDEFFEDCBA9876543210", "22CB48394DFD1977", true]
} }
] ]
}, },
{ {
name: "Generate EMV MAC For PIN Change: issuer script sample", name: "EMV Generate MAC (PIN Change): issuer script sample",
input: "00A4040008A000000004101080D80500000001010A04000000000000", input: "00A4040008A000000004101080D80500000001010A04000000000000",
expectedOutput: "C0F24786EF1C4522", expectedOutput: "C0F24786EF1C4522",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate EMV MAC For PIN Change", op: "EMV Generate MAC (PIN Change)",
args: ["67FB27C75580EFE7", "0123456789ABCDEFFEDCBA9876543210", 8, false] args: ["67FB27C75580EFE7", "0123456789ABCDEFFEDCBA9876543210", 8, false]
} }
] ]
}, },
{ {
name: "Generate Payment PIN Data: ISO Format 0", name: "PIN Data Generate: ISO Format 0",
input: "1234", input: "1234",
expectedOutput: "041215FEDCBA9876", expectedOutput: "041215FEDCBA9876",
recipeConfig: [ recipeConfig: [
{ {
op: "Generate Payment PIN Data", op: "PIN Data Generate",
args: ["ISO Format 0", "5432101234567890", false, false] args: ["ISO Format 0", "5432101234567890", false, false]
} }
] ]
}, },
{ {
name: "Generate IBM 3624 PIN Offset: known sample", name: "IBM 3624 Generate PIN Offset: known sample",
input: "1234", input: "1234",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210", pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@ -713,13 +713,13 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Generate IBM 3624 PIN Offset", op: "IBM 3624 Generate PIN Offset",
args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", true] args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", true]
} }
] ]
}, },
{ {
name: "Verify IBM 3624 PIN: known sample", name: "IBM 3624 Verify PIN: known sample",
input: "1234", input: "1234",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210", pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@ -737,13 +737,13 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Verify IBM 3624 PIN", op: "IBM 3624 Verify PIN",
args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", "3207", true] args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", "3207", true]
} }
] ]
}, },
{ {
name: "Generate VISA PVV: known sample", name: "VISA PVV Generate: known sample",
input: "1234", input: "1234",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210", pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@ -756,13 +756,13 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Generate VISA PVV", op: "VISA PVV Generate",
args: ["0123456789ABCDEFFEDCBA9876543210", "5432101234567890", 1, true] args: ["0123456789ABCDEFFEDCBA9876543210", "5432101234567890", 1, true]
} }
] ]
}, },
{ {
name: "Verify VISA PVV: known sample", name: "VISA PVV Verify: known sample",
input: "1234", input: "1234",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210", pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
@ -777,13 +777,13 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Verify VISA PVV", op: "VISA PVV Verify",
args: ["0123456789ABCDEFFEDCBA9876543210", "5432101234567890", 1, "6077", true] args: ["0123456789ABCDEFFEDCBA9876543210", "5432101234567890", 1, "6077", true]
} }
] ]
}, },
{ {
name: "Generate AS2805 KEK Validation: response sample", name: "AS2805 Generate KEK Validation: response sample",
input: "0123456789ABCDEFFEDCBA9876543210", input: "0123456789ABCDEFFEDCBA9876543210",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
validationType: "KekValidationResponse", validationType: "KekValidationResponse",
@ -795,13 +795,13 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Generate AS2805 KEK Validation", op: "AS2805 Generate KEK Validation",
args: ["KekValidationResponse", "TDES_2KEY", "VARIANT_MASK_82", "9217DC67B8763BABCFDF3DADFCD0F84A", true] args: ["KekValidationResponse", "TDES_2KEY", "VARIANT_MASK_82", "9217DC67B8763BABCFDF3DADFCD0F84A", true]
} }
] ]
}, },
{ {
name: "Verify Payment PIN Data: ISO Format 0", name: "PIN Data Verify: ISO Format 0",
input: "041215FEDCBA9876", input: "041215FEDCBA9876",
expectedOutput: JSON.stringify({ expectedOutput: JSON.stringify({
format: "ISO Format 0", format: "ISO Format 0",
@ -816,7 +816,7 @@ TestRegister.addTests([
}, null, 4), }, null, 4),
recipeConfig: [ recipeConfig: [
{ {
op: "Verify Payment PIN Data", op: "PIN Data Verify",
args: ["ISO Format 0", "5432101234567890", "1234"] args: ["ISO Format 0", "5432101234567890", "1234"]
} }
] ]