Align wording with the shared standard used across all four repos in
this project family. No behavioral change — same rules, consistent text.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Covers the remaining untested cipher profiles in PaymentEncryptData /
PaymentDecryptData. Values are pinned from a clean run against the forge
upstream library, catching regressions in mode selection, IV wiring,
and padding behaviour without re-deriving cryptographic outputs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AES DUKPT IK JSON was missing ksn, iki, counter; working key was missing ksn.
TDES DUKPT IPEK and session key JSON were missing ksn and bdk.
Both now mirror the full derivation context, making json=true self-contained for debugging and cross-validation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
PAYMENT_RECIPES.md was duplicating content now maintained in
J8k3/CyberChef-Payments (recipe catalog, chaining patterns, validation
status). Trimmed to: naming conventions, operation registry, raw APC
comparison test vectors + results. Added pointer to CyberChef-Payments.
AGENTS.md updated:
- Pre-commit checklist now says: update PAYMENT_RECIPES.md operation
registry + CyberChef-Payments README if op appears in catalog
- Added paragraph clarifying the two-file split (dev vs. user-facing)
- Naming convention step now explicitly calls out CyberChef-Payments
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Update opening: workflow-oriented tooling for engineering, debugging,
interoperability, development, QA — replaces narrow regulated-env framing
- Add explicit links to CyberChef-Payments (workflow catalog) and Payments (KB)
near the top
- Replace verbose recipe list (24 entries) with 7 representative examples;
redirect to J8k3/CyberChef-Payments for the full catalog and screenshots
- Fix typo: "Current coverage includes:h" -> "Current coverage includes:"
- Rewrite validation section: remove "unfinished product" and "best validation
we can do" — replace with scoped statement on standards, vectors, and APC
comparison where APIs are comparable
- Restructure: What this fork adds / Scope / Validation / Non-goals / Recipes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Domain prefix must come first per AGENTS.md convention. All references
updated: op file, Categories.json, tests, PAYMENT_RECIPES.md, lib comment.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
eslint:tests catches Payment.mjs too — document that npx grunt eslint runs
all five targets, not just eslint:core.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
11 ESLint errors across 6 files introduced in the ARQC/ARPC/TLV/Script ops.
Also document the constructor-JSDoc and operator-linebreak rules in AGENTS.md
to prevent recurrence.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The one-way rule (CyberChef gaps → GitHub issue) didn't cover the return path.
New paragraph: discoveries from CyberChef sessions (PCI rules, algorithm edge cases,
HSM commands) must be written back into the MCP server in the same session.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Also fixes expectedError test format (OperationErrors surface as result
strings, not result.error) and updates PAYMENT_RECIPES.md docs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
XOR key ceremony helpers: split a key into 2-8 components and recombine.
Chains cleanly with Key Generate and wrap/encrypt operations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- AGENTS.md: add APC cross-reference, security constraint, ESLint, and gap-filing instructions
- PAYMENT_RECIPES.md: DUKPT AES key status to Externally cross-checked; VISA PVV APC results updated with second key cross-check
- README.md: PIN Block Translate Encrypted in coverage list and recipe links
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
X9.24-3 uses AES_Encrypt_ECB for all derivation steps, not AES-CMAC.
Intermediate tree nodes use key usage 0x8000 (not 0x0000), and the
binary tree traversal must cover all 32 counter bits (not 21).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
decimalizePvv() was using a single-pass that immediately mapped A-F to
0-5. The Visa PVV spec (matching ANSI X9.8 and jPOS behavior) requires
two-pass: collect all decimal digits (0-9) first; only then re-scan
mapping A=0 B=1 C=2 D=3 E=4 F=5. This matches decimalizeCvvHex() which
was already correct. Bug produced wrong PVV whenever a hex letter appeared
before the first decimal digit in the encrypted output.
Test vectors updated from "6077" (single-pass result) to "6776" (correct
two-pass result) for the encrypted PVV hex 6A77E65CFE349D60.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
README:
- Added DUKPT AES key derivation to current coverage (ANSI X9.24-3, 12-byte KSN, AES-128)
- Expanded DUKPT TDES line to include standard/KSN details for clarity
- Removed AES DUKPT from Future extensions (it shipped)
PAYMENT_RECIPES:
- Replaced "deprecated" with "removed" for Translate Payment PIN Data (issue #4 was resolved)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AGENTS.md:
- Added npm start (dev server), npm run build (prod), and NODE_OPTIONS heap-size tip from upstream Getting-started wiki
Card Validation Data Generate/Verify:
- Added Profile behaviour note to both descriptions: CVV2 forces service code 000, iCVV forces 999, the arg is ignored for those profiles
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- PIN Data Verify: add Output as JSON toggle (was always returning JSON with no way to get plain boolean; all other verify ops have this toggle)
- EMV Verify MAC: fix inlineHelp to say "session integrity key" (was "session key", inconsistent with arg name and description body)
- DUKPT Derive TDES Key: replace stale "AES DUKPT not implemented" note with pointer to DUKPT Derive AES Key operation
- EMV Generate MAC (PIN Change): replace "Emulation helper" / "This emulation" with "Test helper" / "This operation" throughout description, inlineHelp, and arg comment
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
PVV Verify, IBM 3624 Verify PIN, and EMV Verify ARQC all previously took
the long preimage data as input and the short cryptogram/offset as an arg,
which broke natural recipe chaining from their Generate counterparts.
Swapped each: the short output (PVV, offset, ARQC) now flows in as input;
the preimage/PIN data moves to an arg. Also added an Output as JSON toggle
to EMV Verify ARQC for consistency with other verify operations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Both HSM Parse Thales Command and HSM Parse Futurex Command parse
message framing and field structure only; they do not interpret,
validate, or execute command payloads. Added a prominent Scope note
to this.description and this.inlineHelp on both operations so users
see the limitation before relying on the output for semantic analysis.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
