Rename Derive DUKPT Key to Derive DUKPT TDES Key

Mirrors the naming convention of Derive DUKPT AES Key.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md

@@ -40,7 +40,7 @@ Preferred operation:
 - `Encrypt Payment Data`
 
 Good chain:
-- `Derive DUKPT Key` -> `Triple DES Encrypt`
+- `Derive DUKPT TDES Key` -> `Triple DES Encrypt`
 - `Derive ECDH Key Material` -> KDF if needed -> `AES Encrypt`
 
 Notes:
@@ -52,7 +52,7 @@ Preferred operation:
 - `Decrypt Payment Data`
 
 Good chain:
-- `Derive DUKPT Key` -> `Triple DES Decrypt`
+- `Derive DUKPT TDES Key` -> `Triple DES Decrypt`
 - `Derive ECDH Key Material` -> KDF if needed -> `AES Decrypt`
 
 ## AWS `ReEncryptData`

PAYMENT_RECIPES.md

@@ -206,7 +206,7 @@ Important assumptions:
 ## 9) Key Derivation, Generation, And Validation
 
 Operations:
-- `Derive DUKPT Key` — TDES DUKPT (10-byte KSN, IPEK-based)
+- `Derive DUKPT TDES Key` — TDES DUKPT (10-byte KSN, IPEK-based)
 - `Derive DUKPT AES Key` — AES-128 DUKPT per ANSI X9.24-3 (12-byte KSN, IK-based)
 - `Derive ECDH Key Material`
 - `Generate Key` — random AES-128/192/256, TDES, or custom bytes; optional AES CMAC KCV
@@ -217,7 +217,7 @@ Use this when:
 - you need transaction keys, shared secrets, random test keys, KCVs, or AS2805-style KEK-validation lab values
 
 Important assumptions:
-- `Derive DUKPT Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT)
+- `Derive DUKPT TDES Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT)
 - `Derive DUKPT AES Key` implements AES-128 via AES-CMAC per ANSI X9.24-3; AES-192/256 are not yet implemented
 - `Generate Key` is for test use only — production keys must be generated in an approved HSM
 - `Generate AS2805 KEK Validation` is an emulation-oriented helper and explicitly documents its simplifications in the operation comments
@@ -250,7 +250,7 @@ Important assumptions:
 ## A) TDES DUKPT MAC
 
 Operations:
-- `Derive DUKPT Key`
+- `Derive DUKPT TDES Key`
 - `Generate Payment MAC`
 
 Flow:

src/core/config/Categories.json

@@ -610,7 +610,7 @@
             "Verify IBM 3624 PIN",
             "Generate VISA PVV",
             "Verify VISA PVV",
-            "Derive DUKPT Key",
+            "Derive DUKPT TDES Key",
             "Derive DUKPT AES Key",
             "Generate Key",
             "Calculate Payment KCV",

src/core/operations/DeriveDUKPTKey.mjs

@@ -196,7 +196,7 @@ class DeriveDUKPTKey extends Operation {
     constructor() {
         super();
 
-        this.name = "Derive DUKPT Key";
+        this.name = "Derive DUKPT TDES Key";
         this.module = "Payment";
         this.description = "Paste the Base Derivation Key (BDK) into the input field as a 16-byte hex value.<br><br>Put the 10-byte Key Serial Number in the <b>KSN</b> argument field.<br><br><b>Input:</b> BDK in hex.<br><b>Arguments:</b> choose whether to derive the IPEK or the transaction key, provide the KSN, choose the variant, and optionally return JSON.<br><br>This operation derives TDES DUKPT keys (ANSI X9.24 Part 1) in software for test and interoperability work. It uses a 16-byte BDK and a 10-byte KSN. AES DUKPT (ANSI X9.24 Part 3), which uses a 12-byte KSN and AES keys, is not implemented here.";
         this.inlineHelp = "<strong>Input:</strong> BDK hex.<br><strong>Args:</strong> add the KSN, choose IPEK or transaction-key derivation, then optionally apply a variant.";

tests/operations/tests/Payment.mjs

@@ -316,12 +316,12 @@ TestRegister.addTests([
         ]
     },
     {
-        name: "Derive DUKPT Key: known IPEK vector",
+        name: "Derive DUKPT TDES Key: known IPEK vector",
         input: "0123456789ABCDEFFEDCBA9876543210",
         expectedOutput: "6AC292FAA1315B4D858AB3A3D7D5933A",
         recipeConfig: [
             {
-                op: "Derive DUKPT Key",
+                op: "Derive DUKPT TDES Key",
                 args: ["Derive IPEK", "FFFF9876543210E00008", "None", false]
             }
         ]