Align wording with the shared standard used across all four repos in
this project family. No behavioral change — same rules, consistent text.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Covers the remaining untested cipher profiles in PaymentEncryptData /
PaymentDecryptData. Values are pinned from a clean run against the forge
upstream library, catching regressions in mode selection, IV wiring,
and padding behaviour without re-deriving cryptographic outputs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AES DUKPT IK JSON was missing ksn, iki, counter; working key was missing ksn.
TDES DUKPT IPEK and session key JSON were missing ksn and bdk.
Both now mirror the full derivation context, making json=true self-contained for debugging and cross-validation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
PAYMENT_RECIPES.md was duplicating content now maintained in
J8k3/CyberChef-Payments (recipe catalog, chaining patterns, validation
status). Trimmed to: naming conventions, operation registry, raw APC
comparison test vectors + results. Added pointer to CyberChef-Payments.
AGENTS.md updated:
- Pre-commit checklist now says: update PAYMENT_RECIPES.md operation
registry + CyberChef-Payments README if op appears in catalog
- Added paragraph clarifying the two-file split (dev vs. user-facing)
- Naming convention step now explicitly calls out CyberChef-Payments
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Update opening: workflow-oriented tooling for engineering, debugging,
interoperability, development, QA — replaces narrow regulated-env framing
- Add explicit links to CyberChef-Payments (workflow catalog) and Payments (KB)
near the top
- Replace verbose recipe list (24 entries) with 7 representative examples;
redirect to J8k3/CyberChef-Payments for the full catalog and screenshots
- Fix typo: "Current coverage includes:h" -> "Current coverage includes:"
- Rewrite validation section: remove "unfinished product" and "best validation
we can do" — replace with scoped statement on standards, vectors, and APC
comparison where APIs are comparable
- Restructure: What this fork adds / Scope / Validation / Non-goals / Recipes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Domain prefix must come first per AGENTS.md convention. All references
updated: op file, Categories.json, tests, PAYMENT_RECIPES.md, lib comment.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
eslint:tests catches Payment.mjs too — document that npx grunt eslint runs
all five targets, not just eslint:core.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
11 ESLint errors across 6 files introduced in the ARQC/ARPC/TLV/Script ops.
Also document the constructor-JSDoc and operator-linebreak rules in AGENTS.md
to prevent recurrence.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The one-way rule (CyberChef gaps → GitHub issue) didn't cover the return path.
New paragraph: discoveries from CyberChef sessions (PCI rules, algorithm edge cases,
HSM commands) must be written back into the MCP server in the same session.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Also fixes expectedError test format (OperationErrors surface as result
strings, not result.error) and updates PAYMENT_RECIPES.md docs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
XOR key ceremony helpers: split a key into 2-8 components and recombine.
Chains cleanly with Key Generate and wrap/encrypt operations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- AGENTS.md: add APC cross-reference, security constraint, ESLint, and gap-filing instructions
- PAYMENT_RECIPES.md: DUKPT AES key status to Externally cross-checked; VISA PVV APC results updated with second key cross-check
- README.md: PIN Block Translate Encrypted in coverage list and recipe links
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
X9.24-3 uses AES_Encrypt_ECB for all derivation steps, not AES-CMAC.
Intermediate tree nodes use key usage 0x8000 (not 0x0000), and the
binary tree traversal must cover all 32 counter bits (not 21).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
