From f246a7dcf91b343ea8bcc1bc1a2abf63310869ca Mon Sep 17 00:00:00 2001 From: J8k3 Date: Sun, 17 May 2026 21:56:03 -0400 Subject: [PATCH] Rename Derive DUKPT Key to Derive DUKPT TDES Key Mirrors the naming convention of Derive DUKPT AES Key. Co-Authored-By: Claude Sonnet 4.6 --- AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md | 4 ++-- PAYMENT_RECIPES.md | 6 +++--- src/core/config/Categories.json | 2 +- src/core/operations/DeriveDUKPTKey.mjs | 2 +- tests/operations/tests/Payment.mjs | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md b/AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md index 490f9965..56e1668d 100644 --- a/AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md +++ b/AWS_PAYMENT_CRYPTOGRAPHY_RECIPES.md @@ -40,7 +40,7 @@ Preferred operation: - `Encrypt Payment Data` Good chain: -- `Derive DUKPT Key` -> `Triple DES Encrypt` +- `Derive DUKPT TDES Key` -> `Triple DES Encrypt` - `Derive ECDH Key Material` -> KDF if needed -> `AES Encrypt` Notes: @@ -52,7 +52,7 @@ Preferred operation: - `Decrypt Payment Data` Good chain: -- `Derive DUKPT Key` -> `Triple DES Decrypt` +- `Derive DUKPT TDES Key` -> `Triple DES Decrypt` - `Derive ECDH Key Material` -> KDF if needed -> `AES Decrypt` ## AWS `ReEncryptData` diff --git a/PAYMENT_RECIPES.md b/PAYMENT_RECIPES.md index fe965b6b..79bda021 100644 --- a/PAYMENT_RECIPES.md +++ b/PAYMENT_RECIPES.md @@ -206,7 +206,7 @@ Important assumptions: ## 9) Key Derivation, Generation, And Validation Operations: -- `Derive DUKPT Key` — TDES DUKPT (10-byte KSN, IPEK-based) +- `Derive DUKPT TDES Key` — TDES DUKPT (10-byte KSN, IPEK-based) - `Derive DUKPT AES Key` — AES-128 DUKPT per ANSI X9.24-3 (12-byte KSN, IK-based) - `Derive ECDH Key Material` - `Generate Key` — random AES-128/192/256, TDES, or custom bytes; optional AES CMAC KCV @@ -217,7 +217,7 @@ Use this when: - you need transaction keys, shared secrets, random test keys, KCVs, or AS2805-style KEK-validation lab values Important assumptions: -- `Derive DUKPT Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT) +- `Derive DUKPT TDES Key` is TDES DUKPT — do not confuse IPEK (TDES) with IK (AES DUKPT) - `Derive DUKPT AES Key` implements AES-128 via AES-CMAC per ANSI X9.24-3; AES-192/256 are not yet implemented - `Generate Key` is for test use only — production keys must be generated in an approved HSM - `Generate AS2805 KEK Validation` is an emulation-oriented helper and explicitly documents its simplifications in the operation comments @@ -250,7 +250,7 @@ Important assumptions: ## A) TDES DUKPT MAC Operations: -- `Derive DUKPT Key` +- `Derive DUKPT TDES Key` - `Generate Payment MAC` Flow: diff --git a/src/core/config/Categories.json b/src/core/config/Categories.json index 530f7bb1..74b6a0eb 100644 --- a/src/core/config/Categories.json +++ b/src/core/config/Categories.json @@ -610,7 +610,7 @@ "Verify IBM 3624 PIN", "Generate VISA PVV", "Verify VISA PVV", - "Derive DUKPT Key", + "Derive DUKPT TDES Key", "Derive DUKPT AES Key", "Generate Key", "Calculate Payment KCV", diff --git a/src/core/operations/DeriveDUKPTKey.mjs b/src/core/operations/DeriveDUKPTKey.mjs index 757e2ee6..699a94c3 100644 --- a/src/core/operations/DeriveDUKPTKey.mjs +++ b/src/core/operations/DeriveDUKPTKey.mjs @@ -196,7 +196,7 @@ class DeriveDUKPTKey extends Operation { constructor() { super(); - this.name = "Derive DUKPT Key"; + this.name = "Derive DUKPT TDES Key"; this.module = "Payment"; this.description = "Paste the Base Derivation Key (BDK) into the input field as a 16-byte hex value.

Put the 10-byte Key Serial Number in the KSN argument field.

Input: BDK in hex.
Arguments: choose whether to derive the IPEK or the transaction key, provide the KSN, choose the variant, and optionally return JSON.

This operation derives TDES DUKPT keys (ANSI X9.24 Part 1) in software for test and interoperability work. It uses a 16-byte BDK and a 10-byte KSN. AES DUKPT (ANSI X9.24 Part 3), which uses a 12-byte KSN and AES keys, is not implemented here."; this.inlineHelp = "Input: BDK hex.
Args: add the KSN, choose IPEK or transaction-key derivation, then optionally apply a variant."; diff --git a/tests/operations/tests/Payment.mjs b/tests/operations/tests/Payment.mjs index f90b4afa..0a9d532a 100644 --- a/tests/operations/tests/Payment.mjs +++ b/tests/operations/tests/Payment.mjs @@ -316,12 +316,12 @@ TestRegister.addTests([ ] }, { - name: "Derive DUKPT Key: known IPEK vector", + name: "Derive DUKPT TDES Key: known IPEK vector", input: "0123456789ABCDEFFEDCBA9876543210", expectedOutput: "6AC292FAA1315B4D858AB3A3D7D5933A", recipeConfig: [ { - op: "Derive DUKPT Key", + op: "Derive DUKPT TDES Key", args: ["Derive IPEK", "FFFF9876543210E00008", "None", false] } ]