diff --git a/AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md b/AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md
index 490f9965..56e1668d 100644
--- a/AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md
+++ b/AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md
@@ -40,7 +40,7 @@ Preferred operation:
- `Encrypt Payment Data`
Good chain:
-- `Derive DUKPT Key` -> `Triple DES Encrypt`
+- `Derive DUKPT TDES Key` -> `Triple DES Encrypt`
- `Derive ECDH Key Material` -> KDF if needed -> `AES Encrypt`
Notes:
@@ -52,7 +52,7 @@ Preferred operation:
- `Decrypt Payment Data`
Good chain:
-- `Derive DUKPT Key` -> `Triple DES Decrypt`
+- `Derive DUKPT TDES Key` -> `Triple DES Decrypt`
- `Derive ECDH Key Material` -> KDF if needed -> `AES Decrypt`
## AWS `ReEncryptData`
diff --git a/PAYMENT_RECIPES.md b/PAYMENT_RECIPES.md
index fe965b6b..79bda021 100644
--- a/PAYMENT_RECIPES.md
+++ b/PAYMENT_RECIPES.md
@@ -206,7 +206,7 @@ Important assumptions:
## 9) Key Derivation, Generation, And Validation
Operations:
-- `Derive DUKPT Key` — TDES DUKPT (10-byte KSN, IPEK-based)
+- `Derive DUKPT TDES Key` — TDES DUKPT (10-byte KSN, IPEK-based)
- `Derive DUKPT AES Key` — AES-128 DUKPT per ANSI X9.24-3 (12-byte KSN, IK-based)
- `Derive ECDH Key Material`
- `Generate Key` — random AES-128/192/256, TDES, or custom bytes; optional AES CMAC KCV
@@ -217,7 +217,7 @@ Use this when:
- you need transaction keys, shared secrets, random test keys, KCVs, or AS2805-style KEK-validation lab values
Important assumptions:
-- `Derive DUKPT Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT)
+- `Derive DUKPT TDES Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT)
- `Derive DUKPT AES Key` implements AES-128 via AES-CMAC per ANSI X9.24-3; AES-192/256 are not yet implemented
- `Generate Key` is for test use only — production keys must be generated in an approved HSM
- `Generate AS2805 KEK Validation` is an emulation-oriented helper and explicitly documents its simplifications in the operation comments
@@ -250,7 +250,7 @@ Important assumptions:
## A) TDES DUKPT MAC
Operations:
-- `Derive DUKPT Key`
+- `Derive DUKPT TDES Key`
- `Generate Payment MAC`
Flow:
diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json
index 530f7bb1..74b6a0eb 100644
--- a/src/core/config/Categories.json
+++ b/src/core/config/Categories.json
@@ -610,7 +610,7 @@
"Verify IBM 3624 PIN",
"Generate VISA PVV",
"Verify VISA PVV",
- "Derive DUKPT Key",
+ "Derive DUKPT TDES Key",
"Derive DUKPT AES Key",
"Generate Key",
"Calculate Payment KCV",
diff --git a/src/core/operations/DeriveDUKPTKey.mjs b/src/core/operations/DeriveDUKPTKey.mjs
index 757e2ee6..699a94c3 100644
--- a/src/core/operations/DeriveDUKPTKey.mjs
+++ b/src/core/operations/DeriveDUKPTKey.mjs
@@ -196,7 +196,7 @@ class DeriveDUKPTKey extends Operation {
constructor() {
super();
- this.name = "Derive DUKPT Key";
+ this.name = "Derive DUKPT TDES Key";
this.module = "Payment";
this.description = "Paste the Base Derivation Key (BDK) into the input field as a 16-byte hex value.
Put the 10-byte Key Serial Number in the KSN argument field.
Input: BDK in hex.
Arguments: choose whether to derive the IPEK or the transaction key, provide the KSN, choose the variant, and optionally return JSON.
This operation derives TDES DUKPT keys (ANSI X9.24 Part 1) in software for test and interoperability work. It uses a 16-byte BDK and a 10-byte KSN. AES DUKPT (ANSI X9.24 Part 3), which uses a 12-byte KSN and AES keys, is not implemented here.";
this.inlineHelp = "Input: BDK hex.
Args: add the KSN, choose IPEK or transaction-key derivation, then optionally apply a variant.";
diff --git a/tests/operations/tests/Payment.mjs b/tests/operations/tests/Payment.mjs
index f90b4afa..0a9d532a 100644
--- a/tests/operations/tests/Payment.mjs
+++ b/tests/operations/tests/Payment.mjs
@@ -316,12 +316,12 @@ TestRegister.addTests([
]
},
{
- name: "Derive DUKPT Key: known IPEK vector",
+ name: "Derive DUKPT TDES Key: known IPEK vector",
input: "0123456789ABCDEFFEDCBA9876543210",
expectedOutput: "6AC292FAA1315B4D858AB3A3D7D5933A",
recipeConfig: [
{
- op: "Derive DUKPT Key",
+ op: "Derive DUKPT TDES Key",
args: ["Derive IPEK", "FFFF9876543210E00008", "None", false]
}
]