Rename payment ops to domain-prefix-first; remove upstream ops from Payments category
All 31 payment operation display names now lead with their domain prefix (EMV, DUKPT, PIN Block, PAN, etc.) so they sort and scan by topic in the UI list. 8 upstream CyberChef ops (AES Encrypt/Decrypt, Triple DES, AES Key Wrap/Unwrap, HMAC, CMAC) removed from the Payments category. Updated: op this.name fields, Categories.json, Payment.mjs tests, PAYMENT_RECIPES.md, AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md, AGENTS.md. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
J8k3
parent
32ef373485
commit
634c835dfd
@ -32,7 +32,8 @@
|
||||
When adding, renaming, or removing a payment operation:
|
||||
|
||||
1. **Update `PAYMENT_RECIPES.md`** — add the operation to the correct numbered section and, if it introduces a new chaining pattern, add a lettered chaining pattern entry. Remove or mark deprecated any operations that are replaced.
|
||||
2. **Follow the naming convention** — all payment operation display names use Title Case. Acronyms (DUKPT, AES, EMV, MAC, PAN, TR-31, TR-34, KCV) stay upper-case. Brand names keep their canonical form (`payShield`). Pattern: `[Verb] [Optional Qualifier] [Noun]`. See the Naming Convention section in `PAYMENT_RECIPES.md`.
|
||||
2. **Follow the naming convention** — all payment operation display names use Title Case. Acronyms (DUKPT, AES, EMV, MAC, PAN, TR-31, TR-34, KCV) stay upper-case. Brand names keep their canonical form (`payShield`). Pattern: `[Domain Prefix] [Verb] [Qualifier]` — the domain/protocol prefix comes first so operations sort and scan by topic in the UI list. Example: `EMV Verify MAC`, `DUKPT Derive TDES Key`, `PIN Block Parse`. See the Naming Convention section in `PAYMENT_RECIPES.md`.
|
||||
5. **Only operations written for this fork belong in the Payments category** — do not add upstream CyberChef ops (AES Encrypt, HMAC, CMAC, Triple DES Encrypt, AES Key Wrap, etc.) even as convenience shortcuts. If an op wasn't authored here, it stays in its own upstream category only.
|
||||
3. **Keep `this.name` and file name consistent** — the CyberChef UI shows `this.name`; the file name is the class name in PascalCase. Both should reflect the same intent.
|
||||
4. **Do not rename `this.name` without updating `PAYMENT_RECIPES.md`** — stale names in the doc are confusing and break recipe search.
|
||||
|
||||
|
||||
@ -20,27 +20,27 @@ Coverage legend:
|
||||
|
||||
| AWS operation | Coverage | Use |
|
||||
| --- | --- | --- |
|
||||
| `EncryptData` | `Direct` | `Encrypt Payment Data` |
|
||||
| `DecryptData` | `Direct` | `Decrypt Payment Data` |
|
||||
| `ReEncryptData` | `Direct` | `Re-Encrypt Payment Data` |
|
||||
| `GenerateMac` | `Direct` | `Generate Payment MAC` or `Generate EMV MAC` |
|
||||
| `VerifyMac` | `Direct` | `Verify Payment MAC` or `Verify EMV MAC` |
|
||||
| `VerifyAuthRequestCryptogram` | `Direct` | `Verify EMV ARQC` |
|
||||
| `GenerateCardValidationData` | `Direct` | `Generate Card Validation Data` |
|
||||
| `VerifyCardValidationData` | `Direct` | `Verify Card Validation Data` |
|
||||
| `GeneratePinData` | `Direct` / `Chained` | `Generate Payment PIN Data`, `Generate IBM 3624 PIN Offset`, `Generate VISA PVV` |
|
||||
| `EncryptData` | `Direct` | `Payment Encrypt Data` |
|
||||
| `DecryptData` | `Direct` | `Payment Decrypt Data` |
|
||||
| `ReEncryptData` | `Direct` | `Payment Re-Encrypt Data` |
|
||||
| `GenerateMac` | `Direct` | `MAC Generate` or `EMV Generate MAC` |
|
||||
| `VerifyMac` | `Direct` | `MAC Verify` or `EMV Verify MAC` |
|
||||
| `VerifyAuthRequestCryptogram` | `Direct` | `EMV Verify ARQC` |
|
||||
| `GenerateCardValidationData` | `Direct` | `Card Validation Data Generate` |
|
||||
| `VerifyCardValidationData` | `Direct` | `Card Validation Data Verify` |
|
||||
| `GeneratePinData` | `Direct` / `Chained` | `PIN Data Generate`, `IBM 3624 Generate PIN Offset`, `VISA PVV Generate` |
|
||||
| `TranslatePinData` | `Direct` / `Chained` | `Translate Payment PIN Data` or clear PIN block plus cipher chaining |
|
||||
| `VerifyPinData` | `Direct` | `Verify Payment PIN Data`, `Verify IBM 3624 PIN`, `Verify VISA PVV` |
|
||||
| `VerifyPinData` | `Direct` | `PIN Data Verify`, `IBM 3624 Verify PIN`, `VISA PVV Verify` |
|
||||
| `TranslateKeyMaterial` | `Chained` | `Derive ECDH Key Material` + wrap/unwrap + TR-31/TR-34 helpers |
|
||||
| `GenerateAs2805KekValidation` | `Emulated` | `Generate AS2805 KEK Validation` |
|
||||
| `GenerateMacEmvPinChange` | `Direct` / `Emulated` | `Generate EMV MAC For PIN Change` |
|
||||
| `GenerateAs2805KekValidation` | `Emulated` | `AS2805 Generate KEK Validation` |
|
||||
| `GenerateMacEmvPinChange` | `Direct` / `Emulated` | `EMV Generate MAC (PIN Change)` |
|
||||
|
||||
## AWS `EncryptData`
|
||||
Preferred operation:
|
||||
- `Encrypt Payment Data`
|
||||
- `Payment Encrypt Data`
|
||||
|
||||
Good chain:
|
||||
- `Derive DUKPT TDES Key` -> `Triple DES Encrypt`
|
||||
- `DUKPT Derive TDES Key` -> `Triple DES Encrypt`
|
||||
- `Derive ECDH Key Material` -> KDF if needed -> `AES Encrypt`
|
||||
|
||||
Notes:
|
||||
@ -49,23 +49,23 @@ Notes:
|
||||
|
||||
## AWS `DecryptData`
|
||||
Preferred operation:
|
||||
- `Decrypt Payment Data`
|
||||
- `Payment Decrypt Data`
|
||||
|
||||
Good chain:
|
||||
- `Derive DUKPT TDES Key` -> `Triple DES Decrypt`
|
||||
- `DUKPT Derive TDES Key` -> `Triple DES Decrypt`
|
||||
- `Derive ECDH Key Material` -> KDF if needed -> `AES Decrypt`
|
||||
|
||||
## AWS `ReEncryptData`
|
||||
Preferred operation:
|
||||
- `Re-Encrypt Payment Data`
|
||||
- `Payment Re-Encrypt Data`
|
||||
|
||||
Good chain:
|
||||
- `Decrypt Payment Data` -> `Encrypt Payment Data`
|
||||
- `Payment Decrypt Data` -> `Payment Encrypt Data`
|
||||
|
||||
## AWS `GenerateMac`
|
||||
Preferred operations:
|
||||
- `Generate Payment MAC`
|
||||
- `Generate EMV MAC`
|
||||
- `MAC Generate`
|
||||
- `EMV Generate MAC`
|
||||
|
||||
Current MAC coverage:
|
||||
- HMAC SHA-224 / 256 / 384 / 512
|
||||
@ -79,19 +79,19 @@ Current MAC coverage:
|
||||
- DUKPT ISO 9797-1 Algorithm 3
|
||||
- EMV retail-MAC style generation with a provided session key
|
||||
|
||||
Use `Generate EMV MAC` when:
|
||||
Use `EMV Generate MAC` when:
|
||||
- the AWS flow is EMV-session-key based rather than a static or DUKPT MAC key
|
||||
|
||||
## AWS `VerifyMac`
|
||||
Preferred operations:
|
||||
- `Verify Payment MAC`
|
||||
- `Verify EMV MAC`
|
||||
- `MAC Verify`
|
||||
- `EMV Verify MAC`
|
||||
|
||||
Use the same method, padding rule, and key context as generation.
|
||||
|
||||
## AWS `VerifyAuthRequestCryptogram`
|
||||
Preferred operation:
|
||||
- `Verify EMV ARQC`
|
||||
- `EMV Verify ARQC`
|
||||
|
||||
Good chain:
|
||||
- preassemble the ARQC input block
|
||||
@ -103,7 +103,7 @@ Important assumption:
|
||||
|
||||
## AWS `GenerateCardValidationData`
|
||||
Preferred operation:
|
||||
- `Generate Card Validation Data`
|
||||
- `Card Validation Data Generate`
|
||||
|
||||
Profiles:
|
||||
- CVV / CVC
|
||||
@ -112,31 +112,31 @@ Profiles:
|
||||
|
||||
## AWS `VerifyCardValidationData`
|
||||
Preferred operation:
|
||||
- `Verify Card Validation Data`
|
||||
- `Card Validation Data Verify`
|
||||
|
||||
## AWS `GeneratePinData`
|
||||
Preferred operations:
|
||||
- `Generate Payment PIN Data`
|
||||
- `Generate IBM 3624 PIN Offset`
|
||||
- `Generate VISA PVV`
|
||||
- `PIN Data Generate`
|
||||
- `IBM 3624 Generate PIN Offset`
|
||||
- `VISA PVV Generate`
|
||||
|
||||
Use:
|
||||
- `Generate Payment PIN Data` for clear ISO format `0`, `1`, and `3` PIN blocks
|
||||
- `Generate IBM 3624 PIN Offset` for issuer-host offset workflows
|
||||
- `Generate VISA PVV` for PVV workflows
|
||||
- `PIN Data Generate` for clear ISO format `0`, `1`, and `3` PIN blocks
|
||||
- `IBM 3624 Generate PIN Offset` for issuer-host offset workflows
|
||||
- `VISA PVV Generate` for PVV workflows
|
||||
|
||||
Good chains:
|
||||
- clear PIN -> `Generate Payment PIN Data` -> `Encrypt Payment Data`
|
||||
- clear PIN -> `Generate IBM 3624 PIN Offset`
|
||||
- clear PIN -> `Generate VISA PVV`
|
||||
- clear PIN -> `PIN Data Generate` -> `Payment Encrypt Data`
|
||||
- clear PIN -> `IBM 3624 Generate PIN Offset`
|
||||
- clear PIN -> `VISA PVV Generate`
|
||||
|
||||
## AWS `TranslatePinData`
|
||||
Preferred operation:
|
||||
- `Translate Payment PIN Data`
|
||||
|
||||
Good chains:
|
||||
- `Parse PIN Block` -> inspect -> `Translate PIN Block`
|
||||
- `Decrypt Payment Data` -> `Translate Payment PIN Data` -> `Encrypt Payment Data`
|
||||
- `PIN Block Parse` -> inspect -> `PIN Block Translate`
|
||||
- `Payment Decrypt Data` -> `Translate Payment PIN Data` -> `Payment Encrypt Data`
|
||||
|
||||
Important assumption:
|
||||
- the direct wrapper is for clear ISO PIN-block translation
|
||||
@ -144,14 +144,14 @@ Important assumption:
|
||||
|
||||
## AWS `VerifyPinData`
|
||||
Preferred operations:
|
||||
- `Verify Payment PIN Data`
|
||||
- `Verify IBM 3624 PIN`
|
||||
- `Verify VISA PVV`
|
||||
- `PIN Data Verify`
|
||||
- `IBM 3624 Verify PIN`
|
||||
- `VISA PVV Verify`
|
||||
|
||||
Use:
|
||||
- `Verify Payment PIN Data` for clear ISO PIN blocks
|
||||
- `Verify IBM 3624 PIN` for issuer offset checks
|
||||
- `Verify VISA PVV` for PVV checks
|
||||
- `PIN Data Verify` for clear ISO PIN blocks
|
||||
- `IBM 3624 Verify PIN` for issuer offset checks
|
||||
- `VISA PVV Verify` for PVV checks
|
||||
|
||||
## AWS `TranslateKeyMaterial`
|
||||
Preferred chain:
|
||||
@ -166,7 +166,7 @@ Important assumption:
|
||||
|
||||
## AWS `GenerateAs2805KekValidation`
|
||||
Preferred operation:
|
||||
- `Generate AS2805 KEK Validation`
|
||||
- `AS2805 Generate KEK Validation`
|
||||
|
||||
Important assumption:
|
||||
- this is an explicit software emulation helper
|
||||
@ -174,7 +174,7 @@ Important assumption:
|
||||
|
||||
## AWS `GenerateMacEmvPinChange`
|
||||
Preferred operation:
|
||||
- `Generate EMV MAC For PIN Change`
|
||||
- `EMV Generate MAC (PIN Change)`
|
||||
|
||||
Good chain:
|
||||
- build or obtain the encrypted target PIN block
|
||||
@ -187,7 +187,7 @@ Important assumption:
|
||||
## Common Chains
|
||||
|
||||
## A) DUKPT Request MAC
|
||||
- `Generate Payment MAC`
|
||||
- `MAC Generate`
|
||||
|
||||
Method:
|
||||
- `DUKPT MAC Request CMAC`
|
||||
@ -195,15 +195,15 @@ Method:
|
||||
- or `DUKPT ISO 9797-1 Algorithm 3`
|
||||
|
||||
## B) EMV Issuer Script MAC
|
||||
- `Generate EMV MAC`
|
||||
- `Verify EMV MAC`
|
||||
- `EMV Generate MAC`
|
||||
- `EMV Verify MAC`
|
||||
|
||||
## C) EMV PIN Change
|
||||
- `Generate EMV MAC For PIN Change`
|
||||
- `EMV Generate MAC (PIN Change)`
|
||||
|
||||
## D) Clear PIN To Encrypted PIN Data
|
||||
- `Generate Payment PIN Data`
|
||||
- `Encrypt Payment Data`
|
||||
- `PIN Data Generate`
|
||||
- `Payment Encrypt Data`
|
||||
|
||||
## E) ECDH-Based Key Translation Lab Flow
|
||||
- `Derive ECDH Key Material`
|
||||
|
||||
@ -13,27 +13,28 @@ For validation posture, standards references, and release guardrails, see `PAYME
|
||||
|
||||
All payment operation display names follow **Title Case** throughout. Acronyms (DUKPT, AES, EMV, MAC, PAN, PVV, KCV, ARQC, ARPC, TR-31, TR-34) are always upper-case. Brand names retain their canonical capitalisation (`payShield`).
|
||||
|
||||
Pattern: `[Verb] [Optional Qualifier] [Noun]`
|
||||
Pattern: `[Domain Prefix] [Verb] [Qualifier]`
|
||||
- Domain prefixes: EMV, DUKPT, PIN Block, PIN Data, PAN, Card Validation Data, VISA PVV, IBM 3624, AS2805, HSM, Payment, MAC, Key, TR-31, TR-34
|
||||
- Verbs: Generate, Verify, Parse, Build, Translate, Derive, Calculate, Encrypt, Decrypt, Re-Encrypt
|
||||
- The prefix comes first so operations sort and scan by topic in the UI list
|
||||
- Only operations authored in this fork belong in the Payments category — do not add upstream CyberChef ops
|
||||
- When adding a new payment operation, follow this pattern and update this file.
|
||||
|
||||
## UI Arrangement
|
||||
|
||||
The `Payments` category is arranged in this order:
|
||||
- payment-facing wrappers first
|
||||
- EMV and card-validation flows next
|
||||
- PIN and issuer-verification helpers after that
|
||||
- payment-facing wrappers (Payment Encrypt/Decrypt/Re-Encrypt) first
|
||||
- MAC and EMV flows next
|
||||
- PAN, card, and PIN flows after that
|
||||
- key derivation, generation, KCV, and parser utilities next
|
||||
- generic crypto primitives last for chaining
|
||||
|
||||
That keeps common testing tasks near the top without hiding the underlying `HMAC`, `CMAC`, cipher, and key-wrap primitives that some chains still need.
|
||||
- HSM command parsers last
|
||||
|
||||
## 1) Encrypt / Decrypt / Re-Encrypt Payment Data
|
||||
|
||||
Operations:
|
||||
- `Encrypt Payment Data`
|
||||
- `Decrypt Payment Data`
|
||||
- `Re-Encrypt Payment Data`
|
||||
- `Payment Encrypt Data`
|
||||
- `Payment Decrypt Data`
|
||||
- `Payment Re-Encrypt Data`
|
||||
|
||||
Use this when:
|
||||
- you want payment-facing names for AES, TDES, or the implemented DUKPT-TDES profiles
|
||||
@ -49,8 +50,8 @@ Important assumptions:
|
||||
## 2) Generate / Verify Payment MAC
|
||||
|
||||
Operations:
|
||||
- `Generate Payment MAC`
|
||||
- `Verify Payment MAC`
|
||||
- `MAC Generate`
|
||||
- `MAC Verify`
|
||||
|
||||
Supported methods:
|
||||
- `HMAC SHA-224`
|
||||
@ -81,9 +82,9 @@ Important assumptions:
|
||||
## 3) Generate / Verify EMV MAC
|
||||
|
||||
Operations:
|
||||
- `Generate EMV MAC`
|
||||
- `Verify EMV MAC`
|
||||
- `Generate EMV MAC For PIN Change`
|
||||
- `EMV Generate MAC`
|
||||
- `EMV Verify MAC`
|
||||
- `EMV Generate MAC (PIN Change)`
|
||||
|
||||
Use this when:
|
||||
- you already have the EMV session integrity key
|
||||
@ -96,14 +97,14 @@ Input:
|
||||
Important assumptions:
|
||||
- these operations do not derive EMV session keys
|
||||
- they apply retail-MAC style EMV MAC generation with ISO9797 padding method 2
|
||||
- `Generate EMV MAC For PIN Change` expects the new PIN block to already be encrypted before you call it
|
||||
- `EMV Generate MAC (PIN Change)` expects the new PIN block to already be encrypted before you call it
|
||||
|
||||
## 4) Generate / Verify EMV ARQC And ARPC
|
||||
|
||||
Operations:
|
||||
- `Generate EMV ARQC`
|
||||
- `Verify EMV ARQC`
|
||||
- `Generate EMV ARPC`
|
||||
- `EMV Generate ARQC`
|
||||
- `EMV Verify ARQC`
|
||||
- `EMV Generate ARPC`
|
||||
|
||||
Use this when:
|
||||
- you already know the exact preassembled EMV data block
|
||||
@ -119,10 +120,10 @@ Important assumptions:
|
||||
## 5) Generate / Verify Card Validation Data
|
||||
|
||||
Operations:
|
||||
- `Generate Test PAN`
|
||||
- `Parse PAN`
|
||||
- `Generate Card Validation Data`
|
||||
- `Verify Card Validation Data`
|
||||
- `PAN Generate`
|
||||
- `PAN Parse`
|
||||
- `Card Validation Data Generate`
|
||||
- `Card Validation Data Verify`
|
||||
|
||||
Profiles:
|
||||
- `CVV / CVC (use service code arg)`
|
||||
@ -136,31 +137,31 @@ Important assumptions:
|
||||
- CVV2 forces service code `000`
|
||||
- iCVV forces service code `999`
|
||||
- this is a clear-key software emulation of common card-validation flows
|
||||
- `Parse PAN` now outputs `cardType`, `cardTypeConfidence`, and `majorIndustryIdentifierDescription` in addition to network and Luhn fields
|
||||
- `PAN Parse` now outputs `cardType`, `cardTypeConfidence`, and `majorIndustryIdentifierDescription` in addition to network and Luhn fields
|
||||
|
||||
Recommended chain:
|
||||
- `Generate Test PAN` -> `Parse PAN` -> `Generate Card Validation Data`
|
||||
- `PAN Generate` -> `PAN Parse` -> `Card Validation Data Generate`
|
||||
|
||||
Use `Generate Test PAN` when:
|
||||
Use `PAN Generate` when:
|
||||
- you want a Visa, Mastercard, American Express, or Discover PAN to feed into later recipes
|
||||
|
||||
Use `Parse PAN` when:
|
||||
Use `PAN Parse` when:
|
||||
- you want to confirm network, card type hint, IIN, length, and Luhn validity before continuing
|
||||
|
||||
## 6) Generate / Verify Payment PIN Data
|
||||
|
||||
Operations:
|
||||
- `Generate Payment PIN Data`
|
||||
- `Verify Payment PIN Data`
|
||||
- `PIN Data Generate`
|
||||
- `PIN Data Verify`
|
||||
|
||||
> **Note:** `Translate Payment PIN Data` is deprecated — use `Translate PIN Block` (section 7) instead. See issue #4.
|
||||
> **Note:** `Translate Payment PIN Data` is deprecated — use `PIN Block Translate` (section 7) instead. See issue #4.
|
||||
|
||||
Use this when:
|
||||
- you want AWS-style PIN-data naming for clear ISO 9564 block flows
|
||||
|
||||
Input:
|
||||
- `Generate Payment PIN Data`: clear PIN digits
|
||||
- `Verify Payment PIN Data`: clear PIN block hex
|
||||
- `PIN Data Generate`: clear PIN digits
|
||||
- `PIN Data Verify`: clear PIN block hex
|
||||
|
||||
Important assumptions:
|
||||
- these wrappers currently cover clear ISO formats `0`, `1`, and `3`
|
||||
@ -169,17 +170,17 @@ Important assumptions:
|
||||
## 7) Build / Parse / Translate PIN Block
|
||||
|
||||
Operations:
|
||||
- `Build PIN Block`
|
||||
- `Parse PIN Block`
|
||||
- `Translate PIN Block`
|
||||
- `PIN Block Build`
|
||||
- `PIN Block Parse`
|
||||
- `PIN Block Translate`
|
||||
|
||||
Use this when:
|
||||
- you want the lower-level clear PIN-block tools directly
|
||||
|
||||
Input:
|
||||
- `Build PIN Block`: clear PIN digits
|
||||
- `Parse PIN Block`: clear PIN block hex
|
||||
- `Translate PIN Block`: clear PIN block hex
|
||||
- `PIN Block Build`: clear PIN digits
|
||||
- `PIN Block Parse`: clear PIN block hex
|
||||
- `PIN Block Translate`: clear PIN block hex
|
||||
|
||||
Important assumptions:
|
||||
- current clear-block support is ISO formats `0`, `1`, and `3`
|
||||
@ -187,10 +188,10 @@ Important assumptions:
|
||||
## 8) Issuer PIN Verification Helpers
|
||||
|
||||
Operations:
|
||||
- `Generate IBM 3624 PIN Offset`
|
||||
- `Verify IBM 3624 PIN`
|
||||
- `Generate VISA PVV`
|
||||
- `Verify VISA PVV`
|
||||
- `IBM 3624 Generate PIN Offset`
|
||||
- `IBM 3624 Verify PIN`
|
||||
- `VISA PVV Generate`
|
||||
- `VISA PVV Verify`
|
||||
|
||||
Use this when:
|
||||
- you need issuer-side PIN verification artifacts rather than PIN blocks
|
||||
@ -206,27 +207,27 @@ Important assumptions:
|
||||
## 9) Key Derivation, Generation, And Validation
|
||||
|
||||
Operations:
|
||||
- `Derive DUKPT TDES Key` — TDES DUKPT (10-byte KSN, IPEK-based)
|
||||
- `Derive DUKPT AES Key` — AES-128 DUKPT per ANSI X9.24-3 (12-byte KSN, IK-based)
|
||||
- `DUKPT Derive TDES Key` — TDES DUKPT (10-byte KSN, IPEK-based)
|
||||
- `DUKPT Derive AES Key` — AES-128 DUKPT per ANSI X9.24-3 (12-byte KSN, IK-based)
|
||||
- `Derive ECDH Key Material`
|
||||
- `Generate Key` — random AES-128/192/256, TDES, or custom bytes; optional AES CMAC KCV
|
||||
- `Calculate Payment KCV`
|
||||
- `Generate AS2805 KEK Validation`
|
||||
- `Key Generate` — random AES-128/192/256, TDES, or custom bytes; optional AES CMAC KCV
|
||||
- `Payment Calculate KCV`
|
||||
- `AS2805 Generate KEK Validation`
|
||||
|
||||
Use this when:
|
||||
- you need transaction keys, shared secrets, random test keys, KCVs, or AS2805-style KEK-validation lab values
|
||||
|
||||
Important assumptions:
|
||||
- `Derive DUKPT TDES Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT)
|
||||
- `Derive DUKPT AES Key` implements AES-128 via AES-CMAC per ANSI X9.24-3; AES-192/256 are not yet implemented
|
||||
- `Generate Key` is for test use only — production keys must be generated in an approved HSM
|
||||
- `Generate AS2805 KEK Validation` is an emulation-oriented helper and explicitly documents its simplifications in the operation comments
|
||||
- `DUKPT Derive TDES Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT)
|
||||
- `DUKPT Derive AES Key` implements AES-128 via AES-CMAC per ANSI X9.24-3; AES-192/256 are not yet implemented
|
||||
- `Key Generate` is for test use only — production keys must be generated in an approved HSM
|
||||
- `AS2805 Generate KEK Validation` is an emulation-oriented helper and explicitly documents its simplifications in the operation comments
|
||||
|
||||
## 10) Key Container And HSM Command Inspection
|
||||
|
||||
Operations:
|
||||
- `Parse Thales payShield Command`
|
||||
- `Parse Futurex Excrypt Command`
|
||||
- `HSM Parse Thales Command`
|
||||
- `HSM Parse Futurex Command`
|
||||
- `Parse TR-31 Key Block`
|
||||
- `Parse TR-34 Key Transport`
|
||||
|
||||
@ -234,14 +235,14 @@ Use this when:
|
||||
- you need to inspect vendor HSM command syntax, wrapped-key material, or transport frames during testing
|
||||
|
||||
Input:
|
||||
- `Parse Thales payShield Command`: raw legacy host command or response text
|
||||
- `Parse Futurex Excrypt Command`: raw bracketed Excrypt command or response text
|
||||
- `HSM Parse Thales Command`: raw legacy host command or response text
|
||||
- `HSM Parse Futurex Command`: raw bracketed Excrypt command or response text
|
||||
- `Parse TR-31 Key Block` / `Parse TR-34 Key Transport`: full payload as text or hex, depending on the operation comment
|
||||
|
||||
Important assumptions:
|
||||
- the Thales and Futurex parsers currently focus on visible message syntax, delimiters, command identification, and field splitting rather than deep per-command semantic decoding
|
||||
- `Parse Thales payShield Command` expects the configured message-header length to be supplied in the op args
|
||||
- `Parse Futurex Excrypt Command` treats Excrypt messages as delimiter-based tag/value fields and commonly uses the `AO` field as the command code
|
||||
- `HSM Parse Thales Command` expects the configured message-header length to be supplied in the op args
|
||||
- `HSM Parse Futurex Command` treats Excrypt messages as delimiter-based tag/value fields and commonly uses the `AO` field as the command code
|
||||
- `Parse TR-31 Key Block` decodes all X9.143 header fields with descriptions and PCI compliance flags
|
||||
- `Parse TR-34 Key Transport` handles B0–B9 message types, error codes, and peeks at the outer ASN.1 SEQUENCE of the CMS envelope
|
||||
|
||||
@ -250,18 +251,18 @@ Important assumptions:
|
||||
## A) TDES DUKPT MAC
|
||||
|
||||
Operations:
|
||||
- `Derive DUKPT TDES Key`
|
||||
- `Generate Payment MAC`
|
||||
- `DUKPT Derive TDES Key`
|
||||
- `MAC Generate`
|
||||
|
||||
Flow:
|
||||
- derive the transaction key first if you want to inspect it
|
||||
- or use a DUKPT MAC method directly in `Generate Payment MAC`
|
||||
- or use a DUKPT MAC method directly in `MAC Generate`
|
||||
- use the same KSN and BDK on verify
|
||||
|
||||
## B) AES DUKPT Key Derivation
|
||||
|
||||
Operations:
|
||||
- `Derive DUKPT AES Key`
|
||||
- `DUKPT Derive AES Key`
|
||||
|
||||
Flow:
|
||||
- provide the 16-byte BDK (or IK if you already have it) as hex input
|
||||
@ -287,8 +288,8 @@ Important assumption:
|
||||
## D) Clear PIN Block To Encrypted PIN Data
|
||||
|
||||
Operations:
|
||||
- `Generate Payment PIN Data` or `Build PIN Block`
|
||||
- `Encrypt Payment Data`
|
||||
- `PIN Data Generate` or `PIN Block Build`
|
||||
- `Payment Encrypt Data`
|
||||
|
||||
Flow:
|
||||
- generate the clear ISO PIN block first
|
||||
@ -297,9 +298,9 @@ Flow:
|
||||
## E) EMV ARQC / ARPC Review
|
||||
|
||||
Operations:
|
||||
- `Generate EMV ARQC`
|
||||
- `Verify EMV ARQC`
|
||||
- `Generate EMV ARPC`
|
||||
- `EMV Generate ARQC`
|
||||
- `EMV Verify ARQC`
|
||||
- `EMV Generate ARPC`
|
||||
|
||||
Flow:
|
||||
- build the exact request-data preimage outside the op
|
||||
@ -309,9 +310,9 @@ Flow:
|
||||
## F) EMV Script MAC And PIN Change
|
||||
|
||||
Operations:
|
||||
- `Generate EMV MAC`
|
||||
- `Verify EMV MAC`
|
||||
- `Generate EMV MAC For PIN Change`
|
||||
- `EMV Generate MAC`
|
||||
- `EMV Verify MAC`
|
||||
- `EMV Generate MAC (PIN Change)`
|
||||
|
||||
Flow:
|
||||
- assemble the issuer-script APDU body as hex
|
||||
@ -321,10 +322,10 @@ Flow:
|
||||
## G) IBM 3624 / PVV Verification
|
||||
|
||||
Operations:
|
||||
- `Generate IBM 3624 PIN Offset`
|
||||
- `Verify IBM 3624 PIN`
|
||||
- `Generate VISA PVV`
|
||||
- `Verify VISA PVV`
|
||||
- `IBM 3624 Generate PIN Offset`
|
||||
- `IBM 3624 Verify PIN`
|
||||
- `VISA PVV Generate`
|
||||
- `VISA PVV Verify`
|
||||
|
||||
Flow:
|
||||
- keep the clear PIN in the input field
|
||||
@ -334,10 +335,10 @@ Flow:
|
||||
## H) Brand Test Card Setup
|
||||
|
||||
Operations:
|
||||
- `Generate Test PAN`
|
||||
- `Parse PAN`
|
||||
- `Generate Card Validation Data`
|
||||
- `Generate Payment PIN Data`
|
||||
- `PAN Generate`
|
||||
- `PAN Parse`
|
||||
- `Card Validation Data Generate`
|
||||
- `PIN Data Generate`
|
||||
|
||||
Flow:
|
||||
- generate a curated or locally generated brand-valid PAN
|
||||
@ -347,18 +348,18 @@ Flow:
|
||||
## I) AS2805 KEK Validation
|
||||
|
||||
Operations:
|
||||
- `Generate AS2805 KEK Validation`
|
||||
- `Calculate Payment KCV`
|
||||
- `AS2805 Generate KEK Validation`
|
||||
- `Payment Calculate KCV`
|
||||
|
||||
Flow:
|
||||
- inspect the KEK with `Calculate Payment KCV`
|
||||
- inspect the KEK with `Payment Calculate KCV`
|
||||
- generate request or response RandomKeySend / RandomKeyReceive values with the AS2805 helper
|
||||
|
||||
## J) Vendor Command Triage
|
||||
|
||||
Operations:
|
||||
- `Parse Thales payShield Command`
|
||||
- `Parse Futurex Excrypt Command`
|
||||
- `HSM Parse Thales Command`
|
||||
- `HSM Parse Futurex Command`
|
||||
|
||||
Flow:
|
||||
- paste the raw host message first before trying to interpret the business meaning
|
||||
@ -368,10 +369,10 @@ Flow:
|
||||
## K) Generate And Verify A Test Key
|
||||
|
||||
Operations:
|
||||
- `Generate Key`
|
||||
- `Calculate Payment KCV`
|
||||
- `Key Generate`
|
||||
- `Payment Calculate KCV`
|
||||
|
||||
Flow:
|
||||
- use `Generate Key` with JSON output to get a random AES-128/192/256 or TDES key plus its CMAC KCV
|
||||
- cross-check the KCV with `Calculate Payment KCV` if you need to verify against an HSM-generated value
|
||||
- use `Key Generate` with JSON output to get a random AES-128/192/256 or TDES key plus its CMAC KCV
|
||||
- cross-check the KCV with `Payment Calculate KCV` if you need to verify against an HSM-generated value
|
||||
- pipe the hex key directly into derivation, MAC, or encryption recipes
|
||||
|
||||
@ -586,47 +586,39 @@
|
||||
{
|
||||
"name": "Payments",
|
||||
"ops": [
|
||||
"Encrypt Payment Data",
|
||||
"Decrypt Payment Data",
|
||||
"Re-Encrypt Payment Data",
|
||||
"Generate Payment MAC",
|
||||
"Verify Payment MAC",
|
||||
"Generate EMV MAC",
|
||||
"Verify EMV MAC",
|
||||
"Generate EMV ARQC",
|
||||
"Verify EMV ARQC",
|
||||
"Generate EMV ARPC",
|
||||
"Generate EMV MAC For PIN Change",
|
||||
"Generate Test PAN",
|
||||
"Parse PAN",
|
||||
"Generate Card Validation Data",
|
||||
"Verify Card Validation Data",
|
||||
"Generate Payment PIN Data",
|
||||
"Verify Payment PIN Data",
|
||||
"Build PIN Block",
|
||||
"Parse PIN Block",
|
||||
"Translate PIN Block",
|
||||
"Generate IBM 3624 PIN Offset",
|
||||
"Verify IBM 3624 PIN",
|
||||
"Generate VISA PVV",
|
||||
"Verify VISA PVV",
|
||||
"Derive DUKPT TDES Key",
|
||||
"Derive DUKPT AES Key",
|
||||
"Generate Key",
|
||||
"Calculate Payment KCV",
|
||||
"Generate AS2805 KEK Validation",
|
||||
"Parse Thales payShield Command",
|
||||
"Parse Futurex Excrypt Command",
|
||||
"Payment Encrypt Data",
|
||||
"Payment Decrypt Data",
|
||||
"Payment Re-Encrypt Data",
|
||||
"MAC Generate",
|
||||
"MAC Verify",
|
||||
"EMV Generate MAC",
|
||||
"EMV Verify MAC",
|
||||
"EMV Generate ARQC",
|
||||
"EMV Verify ARQC",
|
||||
"EMV Generate ARPC",
|
||||
"EMV Generate MAC (PIN Change)",
|
||||
"PAN Generate",
|
||||
"PAN Parse",
|
||||
"Card Validation Data Generate",
|
||||
"Card Validation Data Verify",
|
||||
"PIN Data Generate",
|
||||
"PIN Data Verify",
|
||||
"PIN Block Build",
|
||||
"PIN Block Parse",
|
||||
"PIN Block Translate",
|
||||
"IBM 3624 Generate PIN Offset",
|
||||
"IBM 3624 Verify PIN",
|
||||
"VISA PVV Generate",
|
||||
"VISA PVV Verify",
|
||||
"DUKPT Derive TDES Key",
|
||||
"DUKPT Derive AES Key",
|
||||
"Key Generate",
|
||||
"Payment Calculate KCV",
|
||||
"AS2805 Generate KEK Validation",
|
||||
"HSM Parse Thales Command",
|
||||
"HSM Parse Futurex Command",
|
||||
"Parse TR-31 Key Block",
|
||||
"Parse TR-34 Key Transport",
|
||||
"HMAC",
|
||||
"CMAC",
|
||||
"AES Encrypt",
|
||||
"AES Decrypt",
|
||||
"Triple DES Encrypt",
|
||||
"Triple DES Decrypt",
|
||||
"AES Key Wrap",
|
||||
"AES Key Unwrap"
|
||||
"Parse TR-34 Key Transport"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@ -17,7 +17,7 @@ class BuildPINBlock extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Build PIN Block";
|
||||
this.name = "PIN Block Build";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the clear PIN into the input field and choose the ISO 9564 clear PIN block format to build.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> choose the target format, provide the PAN when required, and optionally randomize filler digits for formats 1 and 3.<br><br>This operation currently builds clear test PIN blocks for ISO formats 0, 1, and 3.";
|
||||
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> choose the format, add the PAN for formats 0 and 3, then decide whether format 1 or 3 filler digits should be randomized.";
|
||||
|
||||
@ -20,7 +20,7 @@ class CalculatePaymentKCV extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Calculate Payment KCV";
|
||||
this.name = "Payment Calculate KCV";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the key into the input field and choose how that key is encoded using <b>Key format</b>.<br><br>Use <b>Method</b> to choose the KCV style: TDES, AES-CMAC, AES-ECB, or HMAC.<br><br><b>Input:</b> raw key material such as hex, UTF-8, Latin1, or Base64.<br><b>Arguments:</b> select the key format, method, and output length in hex characters.<br><br>Returns an uppercase truncated hex KCV value.";
|
||||
this.inlineHelp = "<strong>Input:</strong> key material.<br><strong>Args:</strong> tell the op how the key is encoded, choose the KCV method, then set the output length.";
|
||||
|
||||
@ -16,7 +16,7 @@ class DecryptPaymentData extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Decrypt Payment Data";
|
||||
this.name = "Payment Decrypt Data";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste ciphertext into the input field as hex and decrypt it using a payment-facing cipher wrapper.<br><br><b>Input:</b> ciphertext hex.<br><b>Arguments:</b> choose the cipher profile, provide a direct key or BDK, add IV where needed, and provide KSN plus DUKPT variant when using a DUKPT profile.";
|
||||
this.inlineHelp = "<strong>Input:</strong> ciphertext hex.<br><strong>Args:</strong> choose AES, TDES, or DUKPT-wrapped TDES, then provide key, IV, and optional KSN context.";
|
||||
|
||||
@ -259,7 +259,7 @@ class DeriveDUKPTAESKey extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Derive DUKPT AES Key";
|
||||
this.name = "DUKPT Derive AES Key";
|
||||
this.module = "Payment";
|
||||
this.description = [
|
||||
"Derives AES DUKPT working keys per <b>ANSI X9.24-3</b> (AES-128).",
|
||||
|
||||
@ -196,7 +196,7 @@ class DeriveDUKPTKey extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Derive DUKPT TDES Key";
|
||||
this.name = "DUKPT Derive TDES Key";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the Base Derivation Key (BDK) into the input field as a 16-byte hex value.<br><br>Put the 10-byte Key Serial Number in the <b>KSN</b> argument field.<br><br><b>Input:</b> BDK in hex.<br><b>Arguments:</b> choose whether to derive the IPEK or the transaction key, provide the KSN, choose the variant, and optionally return JSON.<br><br>This operation derives TDES DUKPT keys (ANSI X9.24 Part 1) in software for test and interoperability work. It uses a 16-byte BDK and a 10-byte KSN. AES DUKPT (ANSI X9.24 Part 3), which uses a 12-byte KSN and AES keys, is not implemented here.";
|
||||
this.inlineHelp = "<strong>Input:</strong> BDK hex.<br><strong>Args:</strong> add the KSN, choose IPEK or transaction-key derivation, then optionally apply a variant.";
|
||||
|
||||
@ -16,7 +16,7 @@ class EncryptPaymentData extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Encrypt Payment Data";
|
||||
this.name = "Payment Encrypt Data";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste plaintext into the input field as hex and encrypt it using a payment-facing cipher wrapper.<br><br><b>Input:</b> plaintext hex.<br><b>Arguments:</b> choose the cipher profile, provide a direct key or BDK, add IV where needed, and provide KSN plus DUKPT variant when using a DUKPT profile.";
|
||||
this.inlineHelp = "<strong>Input:</strong> plaintext hex.<br><strong>Args:</strong> choose AES, TDES, or DUKPT-wrapped TDES, then provide key, IV, and optional KSN context.";
|
||||
|
||||
@ -47,7 +47,7 @@ class GenerateAS2805KEKValidation extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate AS2805 KEK Validation";
|
||||
this.name = "AS2805 Generate KEK Validation";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the clear sending KEK into the input field as hex and generate an AS2805 KEK validation request or response.<br><br><b>Input:</b> clear KEK as 16-byte or 24-byte hex.<br><b>Arguments:</b> choose request or response mode, select the random-key length, choose the variant mask label, and optionally provide the incoming RandomKeySend value.<br><br><b>Validation:</b> Emulation helper. This software implementation returns <code>RandomKeyReceive</code> as the bytewise inverse of <code>RandomKeySend</code>, which is useful for lab testing but does not claim exact HSM-side AS2805 node-initialization behavior.<br><br><b>Security:</b> Clear KEKs in the recipe are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> clear KEK hex.<br><strong>Args:</strong> choose request or response mode and provide RandomKeySend for response mode.<br><strong>Validation:</strong> explicit emulation, not certified AS2805 behavior.";
|
||||
|
||||
@ -17,7 +17,7 @@ class GenerateCardValidationData extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate Card Validation Data";
|
||||
this.name = "Card Validation Data Generate";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the combined CVK pair into the input field as hex and generate a card-verification value for software testing.<br><br><b>Input:</b> combined CVK pair as 16-byte or 24-byte hex.<br><b>Arguments:</b> select whether you are generating CVV/CVC, CVV2/CVC2, or iCVV, then provide the PAN, expiry components, and service code details.<br><br>This implementation is intended for test harnesses and assumes the common CVV decimalization flow used by payment HSM integrations.";
|
||||
this.inlineHelp = "<strong>Input:</strong> combined CVK pair hex.<br><strong>Args:</strong> choose the validation-data profile, then provide PAN, expiry, and service-code inputs.";
|
||||
|
||||
@ -17,7 +17,7 @@ class GenerateEMVARPC extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate EMV ARPC";
|
||||
this.name = "EMV Generate ARPC";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the already-assembled EMV authorization-response input into the input field as hex and generate an AES-CMAC-based ARPC.<br><br><b>Input:</b> preassembled ARPC input data as hex.<br><b>Arguments:</b> provide the issuer session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV response profiles and does not derive issuer session keys or assemble response fields for you.<br><br><b>Session key derivation:</b> The issuer session key for ARPC generation is typically derived from the same issuer master key used for ARQC verification, using the same ATC-based derivation. The ARPC input data is assembled from the ARQC value and the Authorization Response Code (ARC). This operation expects both the session key and the preimage to be assembled before calling it.<br><br><b>Security:</b> Clear session keys are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> preassembled ARPC data as hex.<br><strong>Args:</strong> provide the issuer AES session key and choose the truncated cryptogram length.<br><strong>Validation:</strong> supplied-key AES-CMAC response profile only.";
|
||||
|
||||
@ -17,7 +17,7 @@ class GenerateEMVARQC extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate EMV ARQC";
|
||||
this.name = "EMV Generate ARQC";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and generate an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key in hex and choose how many bytes of the CMAC should be returned.<br><br><b>Validation:</b> Partially verified. This intentionally covers only supplied-key AES-CMAC-style EMV profiles and does not derive EMV session keys or assemble CDOL data for you.<br><br><b>Session key derivation:</b> In a full EMV flow the session key is derived from the issuer master key using the Application Transaction Counter (ATC) and PAN sequence number. Visa and Amex use EMV Common Session Key Derivation (sometimes called Option A); Mastercard uses a different derivation (Option B). This operation expects you to supply the already-derived session key — use a separate key-derivation step before calling this operation if you need to reproduce a full end-to-end flow.<br><br><b>Security:</b> Clear session keys are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> preassembled ARQC data as hex.<br><strong>Args:</strong> provide the AES session key and choose the truncated cryptogram length.<br><strong>Validation:</strong> supplied-key AES-CMAC profile only.";
|
||||
|
||||
@ -16,7 +16,7 @@ class GenerateEMVMAC extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate EMV MAC";
|
||||
this.name = "EMV Generate MAC";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the issuer-script or EMV command payload into the input field as hex and generate an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and choose how many leftmost MAC bytes to return.<br><br><b>Validation:</b> Partially verified. This implements a retail-MAC style EMV helper with a supplied session key, not full EMV session derivation or brand-specific issuer processing.<br><br><b>Key context:</b> In a full issuer implementation, the session integrity key used here corresponds to the secure-messaging integrity key (distinct from the confidentiality key used to encrypt data and the PIN encryption key used for PIN blocks). This operation accepts any key you supply and does not enforce that separation.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> issuer-script message data as hex.<br><strong>Args:</strong> provide the derived EMV session integrity key.<br><strong>Validation:</strong> supplied-key EMV MAC helper, not full EMV derivation.";
|
||||
|
||||
@ -16,7 +16,7 @@ class GenerateEMVMACForPINChange extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate EMV MAC For PIN Change";
|
||||
this.name = "EMV Generate MAC (PIN Change)";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the issuer-script APDU command into the input field as hex and generate the MAC for an offline EMV PIN-change script.<br><br><b>Input:</b> issuer-script message data as hex.<br><b>Arguments:</b> provide the already-encrypted target PIN block in hex and the already-derived EMV session integrity key.<br><br><b>Validation:</b> Emulation helper. The new PIN block must already be encrypted, and this op appends it to the supplied message before applying the same supplied-key EMV MAC profile used elsewhere in this fork.<br><br><b>Key context:</b> In a full issuer implementation, a PIN-change script involves three distinct keys: a secure-messaging integrity key (for the MAC), a secure-messaging confidentiality key (for encrypting the script data), and a PIN encryption key (for the new PIN block). This operation accepts a single session integrity key and a pre-encrypted PIN block — it does not model the full three-key separation.<br><br><b>Security:</b> Test-only issuer-script assembly with clear session keys in the recipe.";
|
||||
this.inlineHelp = "<strong>Input:</strong> issuer-script APDU message as hex.<br><strong>Args:</strong> provide the encrypted target PIN block and derived EMV integrity key.<br><strong>Validation:</strong> emulation helper for PIN-change script MAC assembly.";
|
||||
|
||||
@ -16,7 +16,7 @@ class GenerateIBM3624PINOffset extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate IBM 3624 PIN Offset";
|
||||
this.name = "IBM 3624 Generate PIN Offset";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the clear PIN into the input field and generate the IBM 3624 offset used by issuer-side PIN verification.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, and pad character.<br><br><b>Validation:</b> Partially verified. This is a clear-key software implementation of the IBM 3624 PIN offset scheme rather than HSM-certified behavior.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, and pad character.<br><strong>Validation:</strong> clear-key IBM 3624 helper.";
|
||||
|
||||
@ -117,7 +117,7 @@ class GenerateKey extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate Key";
|
||||
this.name = "Key Generate";
|
||||
this.module = "Payment";
|
||||
this.description = [
|
||||
"Generates a cryptographically random payment key, IV, or custom-length byte string.",
|
||||
|
||||
@ -17,7 +17,7 @@ class GeneratePaymentMAC extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate Payment MAC";
|
||||
this.name = "MAC Generate";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the message data into the input field and generate a payment-oriented MAC using one payment-facing operation.<br><br><b>Input:</b> message data in the selected input format.<br><b>Arguments:</b> choose the MAC method, provide either a direct key or a DUKPT BDK, optionally provide a KSN for DUKPT methods, choose the ISO9797 padding rule when applicable, and choose the truncation length.<br><br><b>Validation:</b> Mixed. HMAC/CMAC rely on established primitives. ISO9797 / AS2805 and DUKPT modes are software-emulation helpers that need to be interpreted in the scope called out by each method and key context.<br><br><b>Security:</b> Uses clear key material in the recipe. Do not paste production keys into shared or untrusted environments.";
|
||||
this.inlineHelp = "<strong>Input:</strong> message data.<br><strong>Args:</strong> choose the payment MAC method, then provide either a direct key or a DUKPT BDK plus KSN.<br><strong>Validation:</strong> primitive-backed for HMAC/CMAC; broader payment semantics are profile-specific.";
|
||||
|
||||
@ -16,7 +16,7 @@ class GeneratePaymentPINData extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate Payment PIN Data";
|
||||
this.name = "PIN Data Generate";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the clear PIN into the input field and generate clear PIN-block test data.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> choose the PIN-block format, provide the PAN when required, and optionally return structured JSON.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> choose the block format and provide the PAN for PAN-bound formats.<br><strong>Validation:</strong> clear ISO formats 0, 1, and 3 only.";
|
||||
|
||||
@ -16,7 +16,7 @@ class GenerateTestPAN extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate Test PAN";
|
||||
this.name = "PAN Generate";
|
||||
this.module = "Payment";
|
||||
this.description = "Generate a brand-valid payment card number for test workflows.<br><br><b>Input:</b> ignored.<br><b>Arguments:</b> choose the payment network, decide whether to use a curated sample or a locally generated brand-valid PAN, and choose the target length when the network supports multiple lengths.<br><br><b>Validation:</b> Partially verified. Network classification and Luhn behavior are based on public numbering rules. Some curated samples are from public vendor docs, while generated samples are local deterministic test values rather than network-certified sandbox cards.<br><br><b>Security:</b> Test data only. Do not treat generated PANs as live accounts.";
|
||||
this.inlineHelp = "<strong>Input:</strong> ignored.<br><strong>Args:</strong> choose the network, sample mode, and target length.<br><strong>Validation:</strong> public numbering rules + Luhn; not all curated samples are network-published official test cards.";
|
||||
|
||||
@ -16,7 +16,7 @@ class GenerateVISAPVV extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate VISA PVV";
|
||||
this.name = "VISA PVV Generate";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the clear PIN into the input field and generate a VISA PIN Verification Value (PVV).<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, PAN, and PVKI.<br><br><b>Validation:</b> Partially verified. This is a clear-key software implementation of the common VISA PVV assembly pattern, not an HSM-certified PVV service.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, PAN, and PVKI.<br><strong>Validation:</strong> clear-key VISA PVV helper.";
|
||||
|
||||
@ -110,7 +110,7 @@ class ParseFuturexExcryptCommand extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Parse Futurex Excrypt Command";
|
||||
this.name = "HSM Parse Futurex Command";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste a Futurex Excrypt command or response into the input field as text.<br><br><b>General syntax:</b> Excrypt messages are enclosed by opening and closing delimiters, typically <code>[</code> and <code>]</code>. Inside the message, fields are semicolon-delimited. Each field is a tag/value pair, for example <code>AOECHO</code> where <code>AO</code> is the tag and <code>ECHO</code> is the value. The command code is commonly carried in the <code>AO</code> field.<br><br><b>Input:</b> raw Excrypt message text.<br><br>This operation parses the visible Excrypt message syntax, extracts semicolon-delimited fields, splits fields into tag/value pairs, and resolves the <code>AO</code> command code to a known payment command name when available from the Futurex payment integration guide.";
|
||||
this.inlineHelp = "<strong>Syntax:</strong> <code>[tagvalue;tagvalue;...]</code> where fields are separated by semicolons and tags are typically two characters such as <code>AO</code>.<br><strong>Input:</strong> raw Futurex Excrypt message text.";
|
||||
|
||||
@ -16,7 +16,7 @@ class ParsePAN extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Parse PAN";
|
||||
this.name = "PAN Parse";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste a payment card number into the input field and classify it by public network rules.<br><br><b>Input:</b> PAN digits.<br><b>Arguments:</b> none.<br><br><b>Validation:</b> Verified for Luhn behavior and public range matching used in this fork. Classification is limited to the implemented Visa, Mastercard, American Express, and Discover ranges.<br><br><b>Security:</b> PANs may still be sensitive. Use test data wherever possible.";
|
||||
this.inlineHelp = "<strong>Input:</strong> PAN digits only.<br><strong>Args:</strong> none.<br><strong>Validation:</strong> public range matching + Luhn.";
|
||||
|
||||
@ -17,7 +17,7 @@ class ParsePINBlock extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Parse PIN Block";
|
||||
this.name = "PIN Block Parse";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste a clear ISO 9564 PIN block into the input field as hex and decode it into its component fields.<br><br><b>Input:</b> 8-byte clear PIN block as hex.<br><b>Arguments:</b> choose the format and provide the PAN when the format binds to PAN data.<br><br>This operation currently parses clear test PIN blocks for ISO formats 0, 1, and 3.";
|
||||
this.inlineHelp = "<strong>Input:</strong> clear PIN block hex.<br><strong>Args:</strong> choose the format and provide the PAN for formats 0 and 3 so the block can be decoded.";
|
||||
|
||||
@ -255,7 +255,7 @@ class ParseThalesPayShieldCommand extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Parse Thales payShield Command";
|
||||
this.name = "HSM Parse Thales Command";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste a Thales payShield 10K legacy host command or response into the input field as text.<br><br><b>General syntax:</b> optional <code>STX</code>, then <code>m</code> header characters, then a 2-character command or response code, then the command payload, then optionally an LMK suffix such as <code>%nn</code> or <code>~%nn</code>, then optionally <code>X'19'</code> and a message trailer, then optional <code>ETX</code>.<br><br><b>Input:</b> raw command text, optionally including STX/ETX framing, message header, X'19' end-message delimiter, and message trailer.<br><b>Arguments:</b> provide the configured message-header length.<br><br>This operation parses the visible payShield message syntax, identifies the two-character command/response code, resolves the manual command name when known, and extracts any trailing LMK identifier and message trailer.";
|
||||
this.inlineHelp = "<strong>Syntax:</strong> <code>[STX][header m][code 2][payload][~][%nn][EM trailer-delimiter][trailer][ETX]</code>.<br><strong>Input:</strong> raw payShield command or response text.<br><strong>Args:</strong> set the message-header length configured on the HSM link.";
|
||||
|
||||
@ -16,7 +16,7 @@ class ReEncryptPaymentData extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Re-Encrypt Payment Data";
|
||||
this.name = "Payment Re-Encrypt Data";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste ciphertext into the input field as hex, decrypt it under the source key context, then re-encrypt it under the target key context.<br><br><b>Input:</b> source ciphertext hex.<br><b>Arguments:</b> choose source and target profiles, provide the corresponding key or BDK material, add IVs, and supply KSN plus DUKPT variant when using DUKPT profiles.";
|
||||
this.inlineHelp = "<strong>Input:</strong> source ciphertext hex.<br><strong>Args:</strong> define the source decrypt context, then the target encrypt context.";
|
||||
|
||||
@ -17,7 +17,7 @@ class TranslatePINBlock extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Translate PIN Block";
|
||||
this.name = "PIN Block Translate";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste a clear ISO 9564 PIN block into the input field as hex and translate it between supported clear block formats.<br><br><b>Input:</b> 8-byte clear PIN block as hex.<br><b>Arguments:</b> choose the source and target formats, provide source and target PAN values when required, and optionally randomize target filler digits for formats 1 and 3.<br><br>This operation currently translates clear test PIN blocks for ISO formats 0, 1, and 3.<br><br><b>Important:</b> PIN translation must not change the cardholder PAN. Translating a PIN block from one PAN to a different PAN is prohibited by PCI PIN security requirements. Always supply the same PAN for both source and target when the formats require it.";
|
||||
this.inlineHelp = "<strong>Input:</strong> source clear PIN block hex.<br><strong>Args:</strong> choose source and target formats, then provide the source and target PAN values where the formats require them.";
|
||||
|
||||
@ -17,7 +17,7 @@ class VerifyCardValidationData extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Verify Card Validation Data";
|
||||
this.name = "Card Validation Data Verify";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the combined CVK pair into the input field as hex and verify a CVV/CVC-style value for software testing.<br><br><b>Input:</b> combined CVK pair as 16-byte or 24-byte hex.<br><b>Arguments:</b> select the validation-data profile, provide the PAN and expiry components, then supply the expected validation data.<br><br>This operation recomputes the validation value using the same assumptions as the generate operation and reports whether the supplied value matches.";
|
||||
this.inlineHelp = "<strong>Input:</strong> combined CVK pair hex.<br><strong>Args:</strong> provide PAN, expiry, service-code context, and the validation data to check.";
|
||||
|
||||
@ -16,7 +16,7 @@ class VerifyEMVARQC extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Verify EMV ARQC";
|
||||
this.name = "EMV Verify ARQC";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the already-assembled EMV authorization-request input into the input field as hex and verify an AES-CMAC-based ARQC.<br><br><b>Input:</b> preassembled ARQC input data as hex.<br><b>Arguments:</b> provide the EMV session key, cryptogram length, and expected ARQC hex value.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key AES-CMAC EMV profile as generation and does not claim full scheme-level ARQC validation semantics.<br><br><b>Session key derivation:</b> In a full EMV flow the session key is derived from the issuer master key using the Application Transaction Counter (ATC) and PAN sequence number. Visa and Amex use EMV Common Session Key Derivation (Option A); Mastercard uses a different derivation (Option B). This operation expects you to supply the already-derived session key.<br><br><b>Security:</b> Clear session keys are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> preassembled ARQC data as hex.<br><strong>Args:</strong> provide the AES session key and expected ARQC.<br><strong>Validation:</strong> same supplied-key EMV profile as generation.";
|
||||
|
||||
@ -16,7 +16,7 @@ class VerifyEMVMAC extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Verify EMV MAC";
|
||||
this.name = "EMV Verify MAC";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the issuer-script or EMV command payload into the input field as hex and verify an EMV MAC.<br><br><b>Input:</b> message data as hex.<br><b>Arguments:</b> provide the already-derived EMV session integrity key and the expected MAC as hex.<br><br><b>Validation:</b> Partially verified. This checks the same supplied-key EMV MAC profile as the generate operation and does not claim full issuer-host or scheme-specific EMV verification semantics.<br><br><b>Key context:</b> In a full issuer implementation, the session integrity key used here corresponds to the secure-messaging integrity key (distinct from the confidentiality key used to encrypt data and the PIN encryption key used for PIN blocks). This operation accepts any key you supply and does not enforce that separation.<br><br><b>Security:</b> Clear session keys in the recipe are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> issuer-script message data as hex.<br><strong>Args:</strong> provide the derived EMV session key and expected MAC.<br><strong>Validation:</strong> same supplied-key EMV profile as generation.";
|
||||
|
||||
@ -16,7 +16,7 @@ class VerifyIBM3624PIN extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Verify IBM 3624 PIN";
|
||||
this.name = "IBM 3624 Verify PIN";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the clear PIN into the input field and verify it against an IBM 3624 offset.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, decimalization table, validation data, pad character, and expected offset.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key IBM 3624 helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, decimalization table, validation data, pad character, and expected offset.<br><strong>Validation:</strong> clear-key IBM 3624 verification helper.";
|
||||
|
||||
@ -17,7 +17,7 @@ class VerifyPaymentMAC extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Verify Payment MAC";
|
||||
this.name = "MAC Verify";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the message data into the input field and verify a payment-oriented MAC using one payment-facing operation.<br><br><b>Input:</b> message data in the selected input format.<br><b>Arguments:</b> choose the MAC method, provide either a direct key or a DUKPT BDK, add the KSN for DUKPT methods, choose the ISO9797 padding rule when applicable, and supply the expected MAC as hex.<br><br><b>Validation:</b> Uses the same implementation paths and assumptions as the generate operation. Treat ISO9797, AS2805, DUKPT, and EMV-adjacent usage as profile-specific software verification rather than HSM certification.<br><br><b>Security:</b> Uses clear key material in the recipe.";
|
||||
this.inlineHelp = "<strong>Input:</strong> message data.<br><strong>Args:</strong> choose the payment MAC method, provide the key context, then paste the expected MAC.<br><strong>Validation:</strong> same assumptions as generation.";
|
||||
|
||||
@ -16,7 +16,7 @@ class VerifyPaymentPINData extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Verify Payment PIN Data";
|
||||
this.name = "PIN Data Verify";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste a clear PIN block into the input field as hex and verify it against an expected PIN.<br><br><b>Input:</b> clear PIN block hex.<br><b>Arguments:</b> choose the format, provide the PAN when required, and supply the expected clear PIN.<br><br><b>Validation:</b> Partially verified. This wrapper currently covers clear ISO 9564 formats 0, 1, and 3 only.<br><br><b>Security:</b> Clear PIN handling is test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> clear PIN block hex.<br><strong>Args:</strong> define the PIN-block format, PAN context, and expected PIN.<br><strong>Validation:</strong> clear ISO formats 0, 1, and 3 only.";
|
||||
|
||||
@ -16,7 +16,7 @@ class VerifyVISAPVV extends Operation {
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Verify VISA PVV";
|
||||
this.name = "VISA PVV Verify";
|
||||
this.module = "Payment";
|
||||
this.description = "Paste the clear PIN into the input field and verify it against a VISA PVV.<br><br><b>Input:</b> clear PIN digits.<br><b>Arguments:</b> provide the clear PVK in hex, PAN, PVKI, and expected PVV.<br><br><b>Validation:</b> Partially verified. This is the verification pair for the same clear-key VISA PVV helper logic used by generation.<br><br><b>Security:</b> Clear PIN and PVK material are test-use only.";
|
||||
this.inlineHelp = "<strong>Input:</strong> clear PIN digits.<br><strong>Args:</strong> provide PVK, PAN, PVKI, and expected PVV.<br><strong>Validation:</strong> clear-key VISA PVV verification helper.";
|
||||
|
||||
@ -53,7 +53,7 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Parse Thales payShield Command",
|
||||
op: "HSM Parse Thales Command",
|
||||
args: [4]
|
||||
}
|
||||
]
|
||||
@ -87,7 +87,7 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Parse Thales payShield Command",
|
||||
op: "HSM Parse Thales Command",
|
||||
args: [0]
|
||||
}
|
||||
]
|
||||
@ -130,7 +130,7 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Parse Futurex Excrypt Command",
|
||||
op: "HSM Parse Futurex Command",
|
||||
args: []
|
||||
}
|
||||
]
|
||||
@ -175,7 +175,7 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Parse Futurex Excrypt Command",
|
||||
op: "HSM Parse Futurex Command",
|
||||
args: []
|
||||
}
|
||||
]
|
||||
@ -261,84 +261,84 @@ TestRegister.addTests([
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Calculate Payment KCV: HMAC SHA-256",
|
||||
name: "Payment Calculate KCV: HMAC SHA-256",
|
||||
input: "00112233445566778899AABBCCDDEEFF",
|
||||
expectedOutput: "E8A065",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Calculate Payment KCV",
|
||||
op: "Payment Calculate KCV",
|
||||
args: ["Hex", "HMAC SHA-256", 6]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Calculate Payment KCV: AES-CMAC empty",
|
||||
name: "Payment Calculate KCV: AES-CMAC empty",
|
||||
input: "00112233445566778899AABBCCDDEEFF",
|
||||
expectedOutput: "917737",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Calculate Payment KCV",
|
||||
op: "Payment Calculate KCV",
|
||||
args: ["Hex", "AES-CMAC (Empty)", 6]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Calculate Payment KCV: AES-CMAC zeros",
|
||||
name: "Payment Calculate KCV: AES-CMAC zeros",
|
||||
input: "00112233445566778899AABBCCDDEEFF",
|
||||
expectedOutput: "53E107",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Calculate Payment KCV",
|
||||
op: "Payment Calculate KCV",
|
||||
args: ["Hex", "AES-CMAC (Zeros)", 6]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Calculate Payment KCV: AES-CMAC ones",
|
||||
name: "Payment Calculate KCV: AES-CMAC ones",
|
||||
input: "00112233445566778899AABBCCDDEEFF",
|
||||
expectedOutput: "7B3046",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Calculate Payment KCV",
|
||||
op: "Payment Calculate KCV",
|
||||
args: ["Hex", "AES-CMAC (Ones)", 6]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Calculate Payment KCV: AES-ECB zeros",
|
||||
name: "Payment Calculate KCV: AES-ECB zeros",
|
||||
input: "00112233445566778899AABBCCDDEEFF",
|
||||
expectedOutput: "FDE4FB",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Calculate Payment KCV",
|
||||
op: "Payment Calculate KCV",
|
||||
args: ["Hex", "AES-ECB (Zeros)", 6]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Derive DUKPT TDES Key: known IPEK vector",
|
||||
name: "DUKPT Derive TDES Key: known IPEK vector",
|
||||
input: "0123456789ABCDEFFEDCBA9876543210",
|
||||
expectedOutput: "6AC292FAA1315B4D858AB3A3D7D5933A",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Derive DUKPT TDES Key",
|
||||
op: "DUKPT Derive TDES Key",
|
||||
args: ["Derive IPEK", "FFFF9876543210E00008", "None", false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Build PIN Block: ISO Format 0",
|
||||
name: "PIN Block Build: ISO Format 0",
|
||||
input: "1234",
|
||||
expectedOutput: "041215FEDCBA9876",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Build PIN Block",
|
||||
op: "PIN Block Build",
|
||||
args: ["ISO Format 0", "5432101234567890", false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Parse PIN Block: ISO Format 0",
|
||||
name: "PIN Block Parse: ISO Format 0",
|
||||
input: "041215FEDCBA9876",
|
||||
expectedOutput: JSON.stringify({
|
||||
format: "ISO Format 0",
|
||||
@ -351,13 +351,13 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Parse PIN Block",
|
||||
op: "PIN Block Parse",
|
||||
args: ["ISO Format 0", "5432101234567890"]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Translate PIN Block: ISO Format 0 to ISO Format 1",
|
||||
name: "PIN Block Translate: ISO Format 0 to ISO Format 1",
|
||||
input: "041215FEDCBA9876",
|
||||
expectedOutput: JSON.stringify({
|
||||
source: {
|
||||
@ -376,24 +376,24 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Translate PIN Block",
|
||||
op: "PIN Block Translate",
|
||||
args: ["ISO Format 0", "5432101234567890", "ISO Format 1", "", false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Card Validation Data: known CVV2 sample",
|
||||
name: "Card Validation Data Generate: known CVV2 sample",
|
||||
input: "0123456789ABCDEFFEDCBA9876543210",
|
||||
expectedOutput: "221",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Card Validation Data",
|
||||
op: "Card Validation Data Generate",
|
||||
args: ["CVV2 / CVC2 (force 000)", "4123456789012345", "02", "25", "MMYY", "101", 3, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Test PAN: Visa curated sample",
|
||||
name: "PAN Generate: Visa curated sample",
|
||||
input: "",
|
||||
expectedOutput: JSON.stringify({
|
||||
brand: "Visa",
|
||||
@ -415,24 +415,24 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Test PAN",
|
||||
op: "PAN Generate",
|
||||
args: ["Visa", "Curated sample", 16, true]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Test PAN: American Express curated sample",
|
||||
name: "PAN Generate: American Express curated sample",
|
||||
input: "",
|
||||
expectedOutput: "371449635398431",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Test PAN",
|
||||
op: "PAN Generate",
|
||||
args: ["American Express", "Curated sample", 15, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Parse PAN: Discover sample",
|
||||
name: "PAN Parse: Discover sample",
|
||||
input: "6011000991543426",
|
||||
expectedOutput: JSON.stringify({
|
||||
pan: "6011000991543426",
|
||||
@ -454,13 +454,13 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Parse PAN",
|
||||
op: "PAN Parse",
|
||||
args: []
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Verify Card Validation Data: known CVV2 sample",
|
||||
name: "Card Validation Data Verify: known CVV2 sample",
|
||||
input: "0123456789ABCDEFFEDCBA9876543210",
|
||||
expectedOutput: JSON.stringify({
|
||||
profile: "CVV2 / CVC2 (force 000)",
|
||||
@ -478,35 +478,35 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Verify Card Validation Data",
|
||||
op: "Card Validation Data Verify",
|
||||
args: ["CVV2 / CVC2 (force 000)", "4123456789012345", "02", "25", "MMYY", "101", "221"]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate EMV ARQC: AES-CMAC profile",
|
||||
name: "EMV Generate ARQC: AES-CMAC profile",
|
||||
input: "000102030405060708090A0B0C0D0E0F",
|
||||
expectedOutput: "C1F732B52FB20CAA",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate EMV ARQC",
|
||||
op: "EMV Generate ARQC",
|
||||
args: ["00112233445566778899AABBCCDDEEFF", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate EMV ARPC: AES-CMAC profile",
|
||||
name: "EMV Generate ARPC: AES-CMAC profile",
|
||||
input: "11223344556677889900AABBCCDDEEFF",
|
||||
expectedOutput: "312442B1A4D64F94",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate EMV ARPC",
|
||||
op: "EMV Generate ARPC",
|
||||
args: ["00112233445566778899AABBCCDDEEFF", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Verify EMV ARQC: AES-CMAC profile",
|
||||
name: "EMV Verify ARQC: AES-CMAC profile",
|
||||
input: "000102030405060708090A0B0C0D0E0F",
|
||||
expectedOutput: JSON.stringify({
|
||||
inputHex: "000102030405060708090A0B0C0D0E0F",
|
||||
@ -518,112 +518,112 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Verify EMV ARQC",
|
||||
op: "EMV Verify ARQC",
|
||||
args: ["00112233445566778899AABBCCDDEEFF", 8, "C1F732B52FB20CAA"]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Encrypt Payment Data: AES CBC",
|
||||
name: "Payment Encrypt Data: AES CBC",
|
||||
input: "00112233445566778899AABBCCDDEEFF",
|
||||
expectedOutput: "67423557CA0509243B9EE04A5DA3448AA397F6D29B5C8BCE065D9CDC936B7F9B",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Encrypt Payment Data",
|
||||
op: "Payment Encrypt Data",
|
||||
args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Decrypt Payment Data: AES CBC",
|
||||
name: "Payment Decrypt Data: AES CBC",
|
||||
input: "67423557CA0509243B9EE04A5DA3448AA397F6D29B5C8BCE065D9CDC936B7F9B",
|
||||
expectedOutput: "00112233445566778899AABBCCDDEEFF",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Decrypt Payment Data",
|
||||
op: "Payment Decrypt Data",
|
||||
args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Re-Encrypt Payment Data: AES CBC to TDES CBC",
|
||||
name: "Payment Re-Encrypt Data: AES CBC to TDES CBC",
|
||||
input: "67423557CA0509243B9EE04A5DA3448AA397F6D29B5C8BCE065D9CDC936B7F9B",
|
||||
expectedOutput: "C47BC6E91A9D566F649D750BCE1CE9889FB5AE1489A16692",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Re-Encrypt Payment Data",
|
||||
op: "Payment Re-Encrypt Data",
|
||||
args: ["AES CBC", "00112233445566778899AABBCCDDEEFF", "000102030405060708090A0B0C0D0E0F", "", "Data", "TDES CBC", "0123456789ABCDEFFEDCBA9876543210", "1234567890ABCDEF", "", "Data", false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Payment MAC: AES-CMAC",
|
||||
name: "MAC Generate: AES-CMAC",
|
||||
input: "1122334455667788",
|
||||
expectedOutput: "339AF1AD1650E908",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Payment MAC",
|
||||
op: "MAC Generate",
|
||||
args: ["Hex", "AES-CMAC", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Payment MAC: HMAC SHA-256",
|
||||
name: "MAC Generate: HMAC SHA-256",
|
||||
input: "1122334455667788",
|
||||
expectedOutput: "9300E1D36DD30415",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Payment MAC",
|
||||
op: "MAC Generate",
|
||||
args: ["Hex", "HMAC SHA-256", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Payment MAC: DUKPT MAC Request CMAC",
|
||||
name: "MAC Generate: DUKPT MAC Request CMAC",
|
||||
input: "1122334455667788",
|
||||
expectedOutput: "3616961727FE155D",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Payment MAC",
|
||||
op: "MAC Generate",
|
||||
args: ["Hex", "DUKPT MAC Request CMAC", "0123456789ABCDEFFEDCBA9876543210", "Hex", "FFFF9876543210E00008", "Method 1", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Payment MAC: ISO 9797-1 Algorithm 1",
|
||||
name: "MAC Generate: ISO 9797-1 Algorithm 1",
|
||||
input: "1122334455667788",
|
||||
expectedOutput: "0C949BCDEF6FDF1D",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Payment MAC",
|
||||
op: "MAC Generate",
|
||||
args: ["Hex", "ISO 9797-1 Algorithm 1", "0123456789ABCDEFFEDCBA9876543210", "Hex", "", "Method 1", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Payment MAC: ISO 9797-1 Algorithm 3",
|
||||
name: "MAC Generate: ISO 9797-1 Algorithm 3",
|
||||
input: "1122334455667788",
|
||||
expectedOutput: "7E2AEA5CF35FDC0E",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Payment MAC",
|
||||
op: "MAC Generate",
|
||||
args: ["Hex", "ISO 9797-1 Algorithm 3", "0123456789ABCDEFFEDCBA9876543210", "Hex", "", "Method 2", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Payment MAC: AS2805-4.1",
|
||||
name: "MAC Generate: AS2805-4.1",
|
||||
input: "1122334455667788",
|
||||
expectedOutput: "3EB3B72576BBBE83",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Payment MAC",
|
||||
op: "MAC Generate",
|
||||
args: ["Hex", "AS2805-4.1", "0123456789ABCDEFFEDCBA9876543210", "Hex", "", "Method 1", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Verify Payment MAC: AES-CMAC",
|
||||
name: "MAC Verify: AES-CMAC",
|
||||
input: "1122334455667788",
|
||||
expectedOutput: JSON.stringify({
|
||||
method: "AES-CMAC",
|
||||
@ -639,24 +639,24 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Verify Payment MAC",
|
||||
op: "MAC Verify",
|
||||
args: ["Hex", "AES-CMAC", "00112233445566778899AABBCCDDEEFF", "Hex", "", "Method 1", "339AF1AD1650E908", true]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate EMV MAC: issuer script sample",
|
||||
name: "EMV Generate MAC: issuer script sample",
|
||||
input: "8424000008999E57FD0F47CACE0007",
|
||||
expectedOutput: "22CB48394DFD1977",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate EMV MAC",
|
||||
op: "EMV Generate MAC",
|
||||
args: ["0123456789ABCDEFFEDCBA9876543210", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Verify EMV MAC: issuer script sample",
|
||||
name: "EMV Verify MAC: issuer script sample",
|
||||
input: "8424000008999E57FD0F47CACE0007",
|
||||
expectedOutput: JSON.stringify({
|
||||
algorithm: "EMV MAC",
|
||||
@ -669,35 +669,35 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Verify EMV MAC",
|
||||
op: "EMV Verify MAC",
|
||||
args: ["0123456789ABCDEFFEDCBA9876543210", "22CB48394DFD1977", true]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate EMV MAC For PIN Change: issuer script sample",
|
||||
name: "EMV Generate MAC (PIN Change): issuer script sample",
|
||||
input: "00A4040008A000000004101080D80500000001010A04000000000000",
|
||||
expectedOutput: "C0F24786EF1C4522",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate EMV MAC For PIN Change",
|
||||
op: "EMV Generate MAC (PIN Change)",
|
||||
args: ["67FB27C75580EFE7", "0123456789ABCDEFFEDCBA9876543210", 8, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate Payment PIN Data: ISO Format 0",
|
||||
name: "PIN Data Generate: ISO Format 0",
|
||||
input: "1234",
|
||||
expectedOutput: "041215FEDCBA9876",
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate Payment PIN Data",
|
||||
op: "PIN Data Generate",
|
||||
args: ["ISO Format 0", "5432101234567890", false, false]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate IBM 3624 PIN Offset: known sample",
|
||||
name: "IBM 3624 Generate PIN Offset: known sample",
|
||||
input: "1234",
|
||||
expectedOutput: JSON.stringify({
|
||||
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
|
||||
@ -713,13 +713,13 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate IBM 3624 PIN Offset",
|
||||
op: "IBM 3624 Generate PIN Offset",
|
||||
args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", true]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Verify IBM 3624 PIN: known sample",
|
||||
name: "IBM 3624 Verify PIN: known sample",
|
||||
input: "1234",
|
||||
expectedOutput: JSON.stringify({
|
||||
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
|
||||
@ -737,13 +737,13 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Verify IBM 3624 PIN",
|
||||
op: "IBM 3624 Verify PIN",
|
||||
args: ["0123456789ABCDEFFEDCBA9876543210", "0123456789012345", "5432101234567890", "F", "3207", true]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate VISA PVV: known sample",
|
||||
name: "VISA PVV Generate: known sample",
|
||||
input: "1234",
|
||||
expectedOutput: JSON.stringify({
|
||||
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
|
||||
@ -756,13 +756,13 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate VISA PVV",
|
||||
op: "VISA PVV Generate",
|
||||
args: ["0123456789ABCDEFFEDCBA9876543210", "5432101234567890", 1, true]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Verify VISA PVV: known sample",
|
||||
name: "VISA PVV Verify: known sample",
|
||||
input: "1234",
|
||||
expectedOutput: JSON.stringify({
|
||||
pinVerificationKeyHex: "0123456789ABCDEFFEDCBA9876543210",
|
||||
@ -777,13 +777,13 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Verify VISA PVV",
|
||||
op: "VISA PVV Verify",
|
||||
args: ["0123456789ABCDEFFEDCBA9876543210", "5432101234567890", 1, "6077", true]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Generate AS2805 KEK Validation: response sample",
|
||||
name: "AS2805 Generate KEK Validation: response sample",
|
||||
input: "0123456789ABCDEFFEDCBA9876543210",
|
||||
expectedOutput: JSON.stringify({
|
||||
validationType: "KekValidationResponse",
|
||||
@ -795,13 +795,13 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Generate AS2805 KEK Validation",
|
||||
op: "AS2805 Generate KEK Validation",
|
||||
args: ["KekValidationResponse", "TDES_2KEY", "VARIANT_MASK_82", "9217DC67B8763BABCFDF3DADFCD0F84A", true]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Verify Payment PIN Data: ISO Format 0",
|
||||
name: "PIN Data Verify: ISO Format 0",
|
||||
input: "041215FEDCBA9876",
|
||||
expectedOutput: JSON.stringify({
|
||||
format: "ISO Format 0",
|
||||
@ -816,7 +816,7 @@ TestRegister.addTests([
|
||||
}, null, 4),
|
||||
recipeConfig: [
|
||||
{
|
||||
op: "Verify Payment PIN Data",
|
||||
op: "PIN Data Verify",
|
||||
args: ["ISO Format 0", "5432101234567890", "1234"]
|
||||
}
|
||||
]
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user