aws-sdk-paymentcryptographydata 1.26.0 → 1.27.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1cee51842de4f9812872cf67ca217fb988c34615c188f62fa3729519f3bf1fe5
-  data.tar.gz: f34fd2c582c47642ba205dd75025d702810537628ddc752a946593996890213a
+  metadata.gz: ce80c6d4fc0677ab2a7e9c1ee8d7bb0281d03cad13fcd4469fee4a73ba944a9b
+  data.tar.gz: 39aaf7b36d45bc50017b4fa6867f062ca50a0826b9bb16edf75a4c197fd51e6a
 SHA512:
-  metadata.gz: f375a68479f99dacda79e012106a115b94c0c7923834f570cd240b617b134c1b694430e76a8dba737af87c4431487cf49caaf2e68c84e98d86575b174466d7d8
-  data.tar.gz: d178f47a8b714d683ef5e68644f363209799bcc3245b13b3b367d7577eaf7a279ca354019f0d5577d20750b85f9fe70af70cbc1c965db298baf23f8d7f8702c8
+  metadata.gz: df14fd755f08e940389b3c9158cb3ac26d7a83af70045b3835f8fa9a519dc9490d1be75a55bdc4c5b06a69269cc3d7325902bd1ce12ded285dc3f99341996720
+  data.tar.gz: 1dd94acb5900f7ee47894e49fab0ad50c2e21a1ce2ab336cfd7ac0960d279db4f719d55450006f3b610a83c94ee1a34605b06bc349afdbca04ed98b3833e33f2

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.27.0 (2024-10-23)
+------------------
+
+* Feature - Add ECDH support on PIN operations.
+
 1.26.0 (2024-10-21)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.26.0
+1.27.0

data/lib/aws-sdk-paymentcryptographydata/client.rb

@@ -566,6 +566,14 @@ module Aws::PaymentCryptographyData
     #     wrapped_key: {
     #       wrapped_key_material: { # required
     #         tr_31_key_block: "Tr31WrappedKeyBlock",
+    #         diffie_hellman_symmetric_key: {
+    #           certificate_authority_public_key_identifier: "KeyArnOrKeyAliasType", # required
+    #           public_key_certificate: "CertificateType", # required
+    #           key_algorithm: "TDES_2KEY", # required, accepts TDES_2KEY, TDES_3KEY, AES_128, AES_192, AES_256
+    #           key_derivation_function: "NIST_SP800", # required, accepts NIST_SP800, ANSI_X963
+    #           key_derivation_hash_algorithm: "SHA_256", # required, accepts SHA_256, SHA_384, SHA_512
+    #           shared_information: "SharedInformation", # required
+    #         },
     #       },
     #       key_check_value_algorithm: "CMAC", # accepts CMAC, ANSI_X9_24
     #     },
@@ -726,6 +734,14 @@ module Aws::PaymentCryptographyData
     #     wrapped_key: {
     #       wrapped_key_material: { # required
     #         tr_31_key_block: "Tr31WrappedKeyBlock",
+    #         diffie_hellman_symmetric_key: {
+    #           certificate_authority_public_key_identifier: "KeyArnOrKeyAliasType", # required
+    #           public_key_certificate: "CertificateType", # required
+    #           key_algorithm: "TDES_2KEY", # required, accepts TDES_2KEY, TDES_3KEY, AES_128, AES_192, AES_256
+    #           key_derivation_function: "NIST_SP800", # required, accepts NIST_SP800, ANSI_X963
+    #           key_derivation_hash_algorithm: "SHA_256", # required, accepts SHA_256, SHA_384, SHA_512
+    #           shared_information: "SharedInformation", # required
+    #         },
     #       },
     #       key_check_value_algorithm: "CMAC", # accepts CMAC, ANSI_X9_24
     #     },
@@ -1148,9 +1164,18 @@ module Aws::PaymentCryptographyData
     # Cryptography. This operation uses a separate Pin Verification Key
     # (PVK) for VISA PVV generation.
     #
+    # Using ECDH key exchange, you can receive cardholder selectable PINs
+    # into Amazon Web Services Payment Cryptography. The ECDH derived key
+    # protects the incoming PIN block. You can also use it for reveal PIN,
+    # wherein the generated PIN block is protected by the ECDH derived key
+    # before transmission from Amazon Web Services Payment Cryptography. For
+    # more information on establishing ECDH derived keys, see the
+    # [Generating keys][2] in the *Amazon Web Services Payment Cryptography
+    # User Guide*.
+    #
     # For information about valid keys for this operation, see
-    # [Understanding key attributes][2] and [Key types for specific data
-    # operations][3] in the *Amazon Web Services Payment Cryptography User
+    # [Understanding key attributes][3] and [Key types for specific data
+    # operations][4] in the *Amazon Web Services Payment Cryptography User
     # Guide*.
     #
     # **Cross-account use**: This operation can't be used across different
@@ -1167,8 +1192,9 @@ module Aws::PaymentCryptographyData
     #
     #
     # [1]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/generate-pin-data.html
-    # [2]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html
-    # [3]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html
+    # [2]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/create-keys.html
+    # [3]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html
+    # [4]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html
     #
     # @option params [required, String] :generation_key_identifier
     #   The `keyARN` of the PEK that Amazon Web Services Payment Cryptography
@@ -1176,7 +1202,8 @@ module Aws::PaymentCryptographyData
     #
     # @option params [required, String] :encryption_key_identifier
     #   The `keyARN` of the PEK that Amazon Web Services Payment Cryptography
-    #   uses to encrypt the PIN Block.
+    #   uses to encrypt the PIN Block. For ECDH, it is the `keyARN` of the
+    #   asymmetric ECC key.
     #
     # @option params [required, Types::PinGenerationAttributes] :generation_attributes
     #   The attributes and values to use for PIN, PVV, or PIN Offset
@@ -1202,6 +1229,10 @@ module Aws::PaymentCryptographyData
     #   The `ISO_Format_3` PIN block format is the same as `ISO_Format_0`
     #   except that the fill digits are random values from 10 to 15.
     #
+    # @option params [Types::WrappedKey] :encryption_wrapped_key
+    #   Parameter information of a WrappedKeyBlock for encryption key
+    #   exchange.
+    #
     # @return [Types::GeneratePinDataOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::GeneratePinDataOutput#generation_key_arn #generation_key_arn} => String
@@ -1249,7 +1280,21 @@ module Aws::PaymentCryptographyData
     #     },
     #     pin_data_length: 1,
     #     primary_account_number: "PrimaryAccountNumberType", # required
-    #     pin_block_format: "ISO_FORMAT_0", # required, accepts ISO_FORMAT_0, ISO_FORMAT_3
+    #     pin_block_format: "ISO_FORMAT_0", # required, accepts ISO_FORMAT_0, ISO_FORMAT_3, ISO_FORMAT_4
+    #     encryption_wrapped_key: {
+    #       wrapped_key_material: { # required
+    #         tr_31_key_block: "Tr31WrappedKeyBlock",
+    #         diffie_hellman_symmetric_key: {
+    #           certificate_authority_public_key_identifier: "KeyArnOrKeyAliasType", # required
+    #           public_key_certificate: "CertificateType", # required
+    #           key_algorithm: "TDES_2KEY", # required, accepts TDES_2KEY, TDES_3KEY, AES_128, AES_192, AES_256
+    #           key_derivation_function: "NIST_SP800", # required, accepts NIST_SP800, ANSI_X963
+    #           key_derivation_hash_algorithm: "SHA_256", # required, accepts SHA_256, SHA_384, SHA_512
+    #           shared_information: "SharedInformation", # required
+    #         },
+    #       },
+    #       key_check_value_algorithm: "CMAC", # accepts CMAC, ANSI_X9_24
+    #     },
     #   })
     #
     # @example Response structure
@@ -1397,12 +1442,28 @@ module Aws::PaymentCryptographyData
     #     incoming_wrapped_key: {
     #       wrapped_key_material: { # required
     #         tr_31_key_block: "Tr31WrappedKeyBlock",
+    #         diffie_hellman_symmetric_key: {
+    #           certificate_authority_public_key_identifier: "KeyArnOrKeyAliasType", # required
+    #           public_key_certificate: "CertificateType", # required
+    #           key_algorithm: "TDES_2KEY", # required, accepts TDES_2KEY, TDES_3KEY, AES_128, AES_192, AES_256
+    #           key_derivation_function: "NIST_SP800", # required, accepts NIST_SP800, ANSI_X963
+    #           key_derivation_hash_algorithm: "SHA_256", # required, accepts SHA_256, SHA_384, SHA_512
+    #           shared_information: "SharedInformation", # required
+    #         },
     #       },
     #       key_check_value_algorithm: "CMAC", # accepts CMAC, ANSI_X9_24
     #     },
     #     outgoing_wrapped_key: {
     #       wrapped_key_material: { # required
     #         tr_31_key_block: "Tr31WrappedKeyBlock",
+    #         diffie_hellman_symmetric_key: {
+    #           certificate_authority_public_key_identifier: "KeyArnOrKeyAliasType", # required
+    #           public_key_certificate: "CertificateType", # required
+    #           key_algorithm: "TDES_2KEY", # required, accepts TDES_2KEY, TDES_3KEY, AES_128, AES_192, AES_256
+    #           key_derivation_function: "NIST_SP800", # required, accepts NIST_SP800, ANSI_X963
+    #           key_derivation_hash_algorithm: "SHA_256", # required, accepts SHA_256, SHA_384, SHA_512
+    #           shared_information: "SharedInformation", # required
+    #         },
     #       },
     #       key_check_value_algorithm: "CMAC", # accepts CMAC, ANSI_X9_24
     #     },
@@ -1427,24 +1488,36 @@ module Aws::PaymentCryptographyData
     # For more information, see [Translate PIN data][1] in the *Amazon Web
     # Services Payment Cryptography User Guide*.
     #
-    # PIN block translation involves changing the encrytion of PIN block
-    # from one encryption key to another encryption key and changing PIN
-    # block format from one to another without PIN block data leaving Amazon
-    # Web Services Payment Cryptography. The encryption key transformation
-    # can be from PEK (Pin Encryption Key) to BDK (Base Derivation Key) for
-    # DUKPT or from BDK for DUKPT to PEK. Amazon Web Services Payment
-    # Cryptography supports `TDES` and `AES` key derivation type for DUKPT
-    # translations.
+    # PIN block translation involves changing a PIN block from one
+    # encryption key to another and optionally change its format. PIN block
+    # translation occurs entirely within the HSM boundary and PIN data never
+    # enters or leaves Amazon Web Services Payment Cryptography in clear
+    # text. The encryption key transformation can be from PEK (Pin
+    # Encryption Key) to BDK (Base Derivation Key) for DUKPT or from BDK for
+    # DUKPT to PEK.
+    #
+    # Amazon Web Services Payment Cryptography also supports use of dynamic
+    # keys and ECDH (Elliptic Curve Diffie-Hellman) based key exchange for
+    # this operation.
+    #
+    # Dynamic keys allow you to pass a PEK as a TR-31 WrappedKeyBlock. They
+    # can be used when key material is frequently rotated, such as during
+    # every card transaction, and there is need to avoid importing
+    # short-lived keys into Amazon Web Services Payment Cryptography. To
+    # translate PIN block using dynamic keys, the `keyARN` is the Key
+    # Encryption Key (KEK) of the TR-31 wrapped PEK. The incoming wrapped
+    # key shall have a key purpose of P0 with a mode of use of B or D. For
+    # more information, see [Using Dynamic Keys][2] in the *Amazon Web
+    # Services Payment Cryptography User Guide*.
     #
-    # This operation also supports dynamic keys, allowing you to pass a
-    # dynamic PEK as a TR-31 WrappedKeyBlock. This can be used when key
-    # material is frequently rotated, such as during every card transaction,
-    # and there is need to avoid importing short-lived keys into Amazon Web
-    # Services Payment Cryptography. To translate PIN block using dynamic
-    # keys, the `keyARN` is the Key Encryption Key (KEK) of the TR-31
-    # wrapped PEK. The incoming wrapped key shall have a key purpose of P0
-    # with a mode of use of B or D. For more information, see [Using Dynamic
-    # Keys][2] in the *Amazon Web Services Payment Cryptography User Guide*.
+    # Using ECDH key exchange, you can receive cardholder selectable PINs
+    # into Amazon Web Services Payment Cryptography. The ECDH derived key
+    # protects the incoming PIN block, which is translated to a PEK
+    # encrypted PIN block for use within the service. You can also use ECDH
+    # for reveal PIN, wherein the service translates the PIN block from PEK
+    # to a ECDH derived encryption key. For more information on establishing
+    # ECDH derived keys, see the [Generating keys][3] in the *Amazon Web
+    # Services Payment Cryptography User Guide*.
     #
     # The allowed combinations of PIN block format translations are guided
     # by PCI. It is important to note that not all encrypted PIN block
@@ -1454,8 +1527,8 @@ module Aws::PaymentCryptographyData
     # not require a PAN for generation.
     #
     # For information about valid keys for this operation, see
-    # [Understanding key attributes][3] and [Key types for specific data
-    # operations][4] in the *Amazon Web Services Payment Cryptography User
+    # [Understanding key attributes][4] and [Key types for specific data
+    # operations][5] in the *Amazon Web Services Payment Cryptography User
     # Guide*.
     #
     # <note markdown="1"> Amazon Web Services Payment Cryptography currently supports ISO PIN
@@ -1477,21 +1550,23 @@ module Aws::PaymentCryptographyData
     #
     # [1]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/translate-pin-data.html
     # [2]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/use-cases-acquirers-dynamickeys.html
-    # [3]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html
-    # [4]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html
+    # [3]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/create-keys.html
+    # [4]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html
+    # [5]: https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html
     #
     # @option params [required, String] :incoming_key_identifier
     #   The `keyARN` of the encryption key under which incoming PIN block data
     #   is encrypted. This key type can be PEK or BDK.
     #
-    #   When a WrappedKeyBlock is provided, this value will be the identifier
-    #   to the key wrapping key for PIN block. Otherwise, it is the key
-    #   identifier used to perform the operation.
+    #   For dynamic keys, it is the `keyARN` of KEK of the TR-31 wrapped PEK.
+    #   For ECDH, it is the `keyARN` of the asymmetric ECC key.
     #
     # @option params [required, String] :outgoing_key_identifier
     #   The `keyARN` of the encryption key for encrypting outgoing PIN block
     #   data. This key type can be PEK or BDK.
     #
+    #   For ECDH, it is the `keyARN` of the asymmetric ECC key.
+    #
     # @option params [required, Types::TranslationIsoFormats] :incoming_translation_attributes
     #   The format of the incoming PIN block data for translation within
     #   Amazon Web Services Payment Cryptography.
@@ -1571,12 +1646,28 @@ module Aws::PaymentCryptographyData
     #     incoming_wrapped_key: {
     #       wrapped_key_material: { # required
     #         tr_31_key_block: "Tr31WrappedKeyBlock",
+    #         diffie_hellman_symmetric_key: {
+    #           certificate_authority_public_key_identifier: "KeyArnOrKeyAliasType", # required
+    #           public_key_certificate: "CertificateType", # required
+    #           key_algorithm: "TDES_2KEY", # required, accepts TDES_2KEY, TDES_3KEY, AES_128, AES_192, AES_256
+    #           key_derivation_function: "NIST_SP800", # required, accepts NIST_SP800, ANSI_X963
+    #           key_derivation_hash_algorithm: "SHA_256", # required, accepts SHA_256, SHA_384, SHA_512
+    #           shared_information: "SharedInformation", # required
+    #         },
     #       },
     #       key_check_value_algorithm: "CMAC", # accepts CMAC, ANSI_X9_24
     #     },
     #     outgoing_wrapped_key: {
     #       wrapped_key_material: { # required
     #         tr_31_key_block: "Tr31WrappedKeyBlock",
+    #         diffie_hellman_symmetric_key: {
+    #           certificate_authority_public_key_identifier: "KeyArnOrKeyAliasType", # required
+    #           public_key_certificate: "CertificateType", # required
+    #           key_algorithm: "TDES_2KEY", # required, accepts TDES_2KEY, TDES_3KEY, AES_128, AES_192, AES_256
+    #           key_derivation_function: "NIST_SP800", # required, accepts NIST_SP800, ANSI_X963
+    #           key_derivation_hash_algorithm: "SHA_256", # required, accepts SHA_256, SHA_384, SHA_512
+    #           shared_information: "SharedInformation", # required
+    #         },
     #       },
     #       key_check_value_algorithm: "CMAC", # accepts CMAC, ANSI_X9_24
     #     },
@@ -2022,6 +2113,10 @@ module Aws::PaymentCryptographyData
     # @option params [Types::DukptAttributes] :dukpt_attributes
     #   The attributes and values for the DUKPT encrypted PIN block data.
     #
+    # @option params [Types::WrappedKey] :encryption_wrapped_key
+    #   Parameter information of a WrappedKeyBlock for encryption key
+    #   exchange.
+    #
     # @return [Types::VerifyPinDataOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::VerifyPinDataOutput#verification_key_arn #verification_key_arn} => String
@@ -2048,12 +2143,26 @@ module Aws::PaymentCryptographyData
     #     },
     #     encrypted_pin_block: "EncryptedPinBlockType", # required
     #     primary_account_number: "PrimaryAccountNumberType", # required
-    #     pin_block_format: "ISO_FORMAT_0", # required, accepts ISO_FORMAT_0, ISO_FORMAT_3
+    #     pin_block_format: "ISO_FORMAT_0", # required, accepts ISO_FORMAT_0, ISO_FORMAT_3, ISO_FORMAT_4
     #     pin_data_length: 1,
     #     dukpt_attributes: {
     #       key_serial_number: "HexLengthBetween10And24", # required
     #       dukpt_derivation_type: "TDES_2KEY", # required, accepts TDES_2KEY, TDES_3KEY, AES_128, AES_192, AES_256
     #     },
+    #     encryption_wrapped_key: {
+    #       wrapped_key_material: { # required
+    #         tr_31_key_block: "Tr31WrappedKeyBlock",
+    #         diffie_hellman_symmetric_key: {
+    #           certificate_authority_public_key_identifier: "KeyArnOrKeyAliasType", # required
+    #           public_key_certificate: "CertificateType", # required
+    #           key_algorithm: "TDES_2KEY", # required, accepts TDES_2KEY, TDES_3KEY, AES_128, AES_192, AES_256
+    #           key_derivation_function: "NIST_SP800", # required, accepts NIST_SP800, ANSI_X963
+    #           key_derivation_hash_algorithm: "SHA_256", # required, accepts SHA_256, SHA_384, SHA_512
+    #           shared_information: "SharedInformation", # required
+    #         },
+    #       },
+    #       key_check_value_algorithm: "CMAC", # accepts CMAC, ANSI_X9_24
+    #     },
     #   })
     #
     # @example Response structure
@@ -2090,7 +2199,7 @@ module Aws::PaymentCryptographyData
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-paymentcryptographydata'
-      context[:gem_version] = '1.26.0'
+      context[:gem_version] = '1.27.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-paymentcryptographydata/client_api.rb

@@ -28,6 +28,7 @@ module Aws::PaymentCryptographyData
     CardVerificationAttributes = Shapes::UnionShape.new(name: 'CardVerificationAttributes')
     CardVerificationValue1 = Shapes::StructureShape.new(name: 'CardVerificationValue1')
     CardVerificationValue2 = Shapes::StructureShape.new(name: 'CardVerificationValue2')
+    CertificateType = Shapes::StringShape.new(name: 'CertificateType')
     CipherTextType = Shapes::StringShape.new(name: 'CipherTextType')
     CommandMessageDataType = Shapes::StringShape.new(name: 'CommandMessageDataType')
     CryptogramAuthResponse = Shapes::UnionShape.new(name: 'CryptogramAuthResponse')
@@ -47,6 +48,7 @@ module Aws::PaymentCryptographyData
     DukptKeyVariant = Shapes::StringShape.new(name: 'DukptKeyVariant')
     DynamicCardVerificationCode = Shapes::StructureShape.new(name: 'DynamicCardVerificationCode')
     DynamicCardVerificationValue = Shapes::StructureShape.new(name: 'DynamicCardVerificationValue')
+    EcdhDerivationAttributes = Shapes::StructureShape.new(name: 'EcdhDerivationAttributes')
     Emv2000Attributes = Shapes::StructureShape.new(name: 'Emv2000Attributes')
     EmvCommonAttributes = Shapes::StructureShape.new(name: 'EmvCommonAttributes')
     EmvEncryptionAttributes = Shapes::StructureShape.new(name: 'EmvEncryptionAttributes')
@@ -87,6 +89,8 @@ module Aws::PaymentCryptographyData
     KeyArnOrKeyAliasType = Shapes::StringShape.new(name: 'KeyArnOrKeyAliasType')
     KeyCheckValue = Shapes::StringShape.new(name: 'KeyCheckValue')
     KeyCheckValueAlgorithm = Shapes::StringShape.new(name: 'KeyCheckValueAlgorithm')
+    KeyDerivationFunction = Shapes::StringShape.new(name: 'KeyDerivationFunction')
+    KeyDerivationHashAlgorithm = Shapes::StringShape.new(name: 'KeyDerivationHashAlgorithm')
     MacAlgorithm = Shapes::StringShape.new(name: 'MacAlgorithm')
     MacAlgorithmDukpt = Shapes::StructureShape.new(name: 'MacAlgorithmDukpt')
     MacAlgorithmEmv = Shapes::StructureShape.new(name: 'MacAlgorithmEmv')
@@ -127,8 +131,10 @@ module Aws::PaymentCryptographyData
     SessionKeyEmvCommon = Shapes::StructureShape.new(name: 'SessionKeyEmvCommon')
     SessionKeyMastercard = Shapes::StructureShape.new(name: 'SessionKeyMastercard')
     SessionKeyVisa = Shapes::StructureShape.new(name: 'SessionKeyVisa')
+    SharedInformation = Shapes::StringShape.new(name: 'SharedInformation')
     String = Shapes::StringShape.new(name: 'String')
     SymmetricEncryptionAttributes = Shapes::StructureShape.new(name: 'SymmetricEncryptionAttributes')
+    SymmetricKeyAlgorithm = Shapes::StringShape.new(name: 'SymmetricKeyAlgorithm')
     ThrottlingException = Shapes::StructureShape.new(name: 'ThrottlingException')
     Tr31WrappedKeyBlock = Shapes::StringShape.new(name: 'Tr31WrappedKeyBlock')
     TrackDataType = Shapes::StringShape.new(name: 'TrackDataType')
@@ -309,6 +315,14 @@ module Aws::PaymentCryptographyData
     DynamicCardVerificationValue.add_member(:application_transaction_counter, Shapes::ShapeRef.new(shape: HexLengthBetween2And4, required: true, location_name: "ApplicationTransactionCounter"))
     DynamicCardVerificationValue.struct_class = Types::DynamicCardVerificationValue
 
+    EcdhDerivationAttributes.add_member(:certificate_authority_public_key_identifier, Shapes::ShapeRef.new(shape: KeyArnOrKeyAliasType, required: true, location_name: "CertificateAuthorityPublicKeyIdentifier"))
+    EcdhDerivationAttributes.add_member(:public_key_certificate, Shapes::ShapeRef.new(shape: CertificateType, required: true, location_name: "PublicKeyCertificate"))
+    EcdhDerivationAttributes.add_member(:key_algorithm, Shapes::ShapeRef.new(shape: SymmetricKeyAlgorithm, required: true, location_name: "KeyAlgorithm"))
+    EcdhDerivationAttributes.add_member(:key_derivation_function, Shapes::ShapeRef.new(shape: KeyDerivationFunction, required: true, location_name: "KeyDerivationFunction"))
+    EcdhDerivationAttributes.add_member(:key_derivation_hash_algorithm, Shapes::ShapeRef.new(shape: KeyDerivationHashAlgorithm, required: true, location_name: "KeyDerivationHashAlgorithm"))
+    EcdhDerivationAttributes.add_member(:shared_information, Shapes::ShapeRef.new(shape: SharedInformation, required: true, location_name: "SharedInformation"))
+    EcdhDerivationAttributes.struct_class = Types::EcdhDerivationAttributes
+
     Emv2000Attributes.add_member(:major_key_derivation_mode, Shapes::ShapeRef.new(shape: MajorKeyDerivationMode, required: true, location_name: "MajorKeyDerivationMode"))
     Emv2000Attributes.add_member(:primary_account_number, Shapes::ShapeRef.new(shape: PrimaryAccountNumberType, required: true, location_name: "PrimaryAccountNumber"))
     Emv2000Attributes.add_member(:pan_sequence_number, Shapes::ShapeRef.new(shape: NumberLengthEquals2, required: true, location_name: "PanSequenceNumber"))
@@ -403,6 +417,7 @@ module Aws::PaymentCryptographyData
     GeneratePinDataInput.add_member(:pin_data_length, Shapes::ShapeRef.new(shape: IntegerRangeBetween4And12, location_name: "PinDataLength"))
     GeneratePinDataInput.add_member(:primary_account_number, Shapes::ShapeRef.new(shape: PrimaryAccountNumberType, required: true, location_name: "PrimaryAccountNumber"))
     GeneratePinDataInput.add_member(:pin_block_format, Shapes::ShapeRef.new(shape: PinBlockFormatForPinData, required: true, location_name: "PinBlockFormat"))
+    GeneratePinDataInput.add_member(:encryption_wrapped_key, Shapes::ShapeRef.new(shape: WrappedKey, location_name: "EncryptionWrappedKey"))
     GeneratePinDataInput.struct_class = Types::GeneratePinDataInput
 
     GeneratePinDataOutput.add_member(:generation_key_arn, Shapes::ShapeRef.new(shape: KeyArn, required: true, location_name: "GenerationKeyArn"))
@@ -676,6 +691,7 @@ module Aws::PaymentCryptographyData
     VerifyPinDataInput.add_member(:pin_block_format, Shapes::ShapeRef.new(shape: PinBlockFormatForPinData, required: true, location_name: "PinBlockFormat"))
     VerifyPinDataInput.add_member(:pin_data_length, Shapes::ShapeRef.new(shape: IntegerRangeBetween4And12, location_name: "PinDataLength"))
     VerifyPinDataInput.add_member(:dukpt_attributes, Shapes::ShapeRef.new(shape: DukptAttributes, location_name: "DukptAttributes"))
+    VerifyPinDataInput.add_member(:encryption_wrapped_key, Shapes::ShapeRef.new(shape: WrappedKey, location_name: "EncryptionWrappedKey"))
     VerifyPinDataInput.struct_class = Types::VerifyPinDataInput
 
     VerifyPinDataOutput.add_member(:verification_key_arn, Shapes::ShapeRef.new(shape: KeyArn, required: true, location_name: "VerificationKeyArn"))
@@ -714,8 +730,10 @@ module Aws::PaymentCryptographyData
     WrappedKey.struct_class = Types::WrappedKey
 
     WrappedKeyMaterial.add_member(:tr_31_key_block, Shapes::ShapeRef.new(shape: Tr31WrappedKeyBlock, location_name: "Tr31KeyBlock"))
+    WrappedKeyMaterial.add_member(:diffie_hellman_symmetric_key, Shapes::ShapeRef.new(shape: EcdhDerivationAttributes, location_name: "DiffieHellmanSymmetricKey"))
     WrappedKeyMaterial.add_member(:unknown, Shapes::ShapeRef.new(shape: nil, location_name: 'unknown'))
     WrappedKeyMaterial.add_member_subclass(:tr_31_key_block, Types::WrappedKeyMaterial::Tr31KeyBlock)
+    WrappedKeyMaterial.add_member_subclass(:diffie_hellman_symmetric_key, Types::WrappedKeyMaterial::DiffieHellmanSymmetricKey)
     WrappedKeyMaterial.add_member_subclass(:unknown, Types::WrappedKeyMaterial::Unknown)
     WrappedKeyMaterial.struct_class = Types::WrappedKeyMaterial
 

data/lib/aws-sdk-paymentcryptographydata/types.rb

@@ -714,6 +714,53 @@ module Aws::PaymentCryptographyData
       include Aws::Structure
     end
 
+    # Parameters required to establish ECDH based key exchange.
+    #
+    # @!attribute [rw] certificate_authority_public_key_identifier
+    #   The `keyArn` of the certificate that signed the client's
+    #   `PublicKeyCertificate`.
+    #   @return [String]
+    #
+    # @!attribute [rw] public_key_certificate
+    #   The client's public key certificate in PEM format (base64 encoded)
+    #   to use for ECDH key derivation.
+    #   @return [String]
+    #
+    # @!attribute [rw] key_algorithm
+    #   The key algorithm of the derived ECDH key.
+    #   @return [String]
+    #
+    # @!attribute [rw] key_derivation_function
+    #   The key derivation function to use for deriving a key using ECDH.
+    #   @return [String]
+    #
+    # @!attribute [rw] key_derivation_hash_algorithm
+    #   The hash type to use for deriving a key using ECDH.
+    #   @return [String]
+    #
+    # @!attribute [rw] shared_information
+    #   A byte string containing information that binds the ECDH derived key
+    #   to the two parties involved or to the context of the key.
+    #
+    #   It may include details like identities of the two parties deriving
+    #   the key, context of the operation, session IDs, and optionally a
+    #   nonce. It must not contain zero bytes, and re-using shared
+    #   information for multiple ECDH key derivations is not recommended.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/payment-cryptography-data-2022-02-03/EcdhDerivationAttributes AWS API Documentation
+    #
+    class EcdhDerivationAttributes < Struct.new(
+      :certificate_authority_public_key_identifier,
+      :public_key_certificate,
+      :key_algorithm,
+      :key_derivation_function,
+      :key_derivation_hash_algorithm,
+      :shared_information)
+      SENSITIVE = [:public_key_certificate]
+      include Aws::Structure
+    end
+
     # Parameters to derive the confidentiality and integrity keys for a
     # payment card using EMV2000 deruv.
     #
@@ -1200,7 +1247,8 @@ module Aws::PaymentCryptographyData
     #
     # @!attribute [rw] encryption_key_identifier
     #   The `keyARN` of the PEK that Amazon Web Services Payment
-    #   Cryptography uses to encrypt the PIN Block.
+    #   Cryptography uses to encrypt the PIN Block. For ECDH, it is the
+    #   `keyARN` of the asymmetric ECC key.
     #   @return [String]
     #
     # @!attribute [rw] generation_attributes
@@ -1231,6 +1279,11 @@ module Aws::PaymentCryptographyData
     #   except that the fill digits are random values from 10 to 15.
     #   @return [String]
     #
+    # @!attribute [rw] encryption_wrapped_key
+    #   Parameter information of a WrappedKeyBlock for encryption key
+    #   exchange.
+    #   @return [Types::WrappedKey]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/payment-cryptography-data-2022-02-03/GeneratePinDataInput AWS API Documentation
     #
     class GeneratePinDataInput < Struct.new(
@@ -1239,7 +1292,8 @@ module Aws::PaymentCryptographyData
       :generation_attributes,
       :pin_data_length,
       :primary_account_number,
-      :pin_block_format)
+      :pin_block_format,
+      :encryption_wrapped_key)
       SENSITIVE = [:primary_account_number]
       include Aws::Structure
     end
@@ -1260,7 +1314,8 @@ module Aws::PaymentCryptographyData
     #
     # @!attribute [rw] encryption_key_arn
     #   The `keyARN` of the PEK that Amazon Web Services Payment
-    #   Cryptography uses for encrypted pin block generation.
+    #   Cryptography uses for encrypted pin block generation. For ECDH, it
+    #   is the `keyARN` of the asymmetric ECC key.
     #   @return [String]
     #
     # @!attribute [rw] encryption_key_check_value
@@ -2110,14 +2165,15 @@ module Aws::PaymentCryptographyData
     #   The `keyARN` of the encryption key under which incoming PIN block
     #   data is encrypted. This key type can be PEK or BDK.
     #
-    #   When a WrappedKeyBlock is provided, this value will be the
-    #   identifier to the key wrapping key for PIN block. Otherwise, it is
-    #   the key identifier used to perform the operation.
+    #   For dynamic keys, it is the `keyARN` of KEK of the TR-31 wrapped
+    #   PEK. For ECDH, it is the `keyARN` of the asymmetric ECC key.
     #   @return [String]
     #
     # @!attribute [rw] outgoing_key_identifier
     #   The `keyARN` of the encryption key for encrypting outgoing PIN block
     #   data. This key type can be PEK or BDK.
+    #
+    #   For ECDH, it is the `keyARN` of the asymmetric ECC key.
     #   @return [String]
     #
     # @!attribute [rw] incoming_translation_attributes
@@ -2557,6 +2613,11 @@ module Aws::PaymentCryptographyData
     #   The attributes and values for the DUKPT encrypted PIN block data.
     #   @return [Types::DukptAttributes]
     #
+    # @!attribute [rw] encryption_wrapped_key
+    #   Parameter information of a WrappedKeyBlock for encryption key
+    #   exchange.
+    #   @return [Types::WrappedKey]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/payment-cryptography-data-2022-02-03/VerifyPinDataInput AWS API Documentation
     #
     class VerifyPinDataInput < Struct.new(
@@ -2567,7 +2628,8 @@ module Aws::PaymentCryptographyData
       :primary_account_number,
       :pin_block_format,
       :pin_data_length,
-      :dukpt_attributes)
+      :dukpt_attributes,
+      :encryption_wrapped_key)
       SENSITIVE = [:encrypted_pin_block, :primary_account_number]
       include Aws::Structure
     end
@@ -2782,16 +2844,22 @@ module Aws::PaymentCryptographyData
     #   The TR-31 wrapped key block.
     #   @return [String]
     #
+    # @!attribute [rw] diffie_hellman_symmetric_key
+    #   The parameter information for deriving a ECDH shared key.
+    #   @return [Types::EcdhDerivationAttributes]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/payment-cryptography-data-2022-02-03/WrappedKeyMaterial AWS API Documentation
     #
     class WrappedKeyMaterial < Struct.new(
       :tr_31_key_block,
+      :diffie_hellman_symmetric_key,
       :unknown)
       SENSITIVE = [:tr_31_key_block]
       include Aws::Structure
       include Aws::Structure::Union
 
       class Tr31KeyBlock < WrappedKeyMaterial; end
+      class DiffieHellmanSymmetricKey < WrappedKeyMaterial; end
       class Unknown < WrappedKeyMaterial; end
     end
 

data/lib/aws-sdk-paymentcryptographydata.rb

@@ -55,7 +55,7 @@ module Aws::PaymentCryptographyData
   autoload :EndpointProvider, 'aws-sdk-paymentcryptographydata/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-paymentcryptographydata/endpoints'
 
-  GEM_VERSION = '1.26.0'
+  GEM_VERSION = '1.27.0'
 
 end
 

data/sig/client.rbs

@@ -112,7 +112,15 @@ module Aws
                           },
                           ?wrapped_key: {
                             wrapped_key_material: {
-                              tr_31_key_block: ::String?
+                              tr_31_key_block: ::String?,
+                              diffie_hellman_symmetric_key: {
+                                certificate_authority_public_key_identifier: ::String,
+                                public_key_certificate: ::String,
+                                key_algorithm: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256"),
+                                key_derivation_function: ("NIST_SP800" | "ANSI_X963"),
+                                key_derivation_hash_algorithm: ("SHA_256" | "SHA_384" | "SHA_512"),
+                                shared_information: ::String
+                              }?
                             },
                             key_check_value_algorithm: ("CMAC" | "ANSI_X9_24")?
                           }
@@ -156,7 +164,15 @@ module Aws
                           },
                           ?wrapped_key: {
                             wrapped_key_material: {
-                              tr_31_key_block: ::String?
+                              tr_31_key_block: ::String?,
+                              diffie_hellman_symmetric_key: {
+                                certificate_authority_public_key_identifier: ::String,
+                                public_key_certificate: ::String,
+                                key_algorithm: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256"),
+                                key_derivation_function: ("NIST_SP800" | "ANSI_X963"),
+                                key_derivation_hash_algorithm: ("SHA_256" | "SHA_384" | "SHA_512"),
+                                shared_information: ::String
+                              }?
                             },
                             key_check_value_algorithm: ("CMAC" | "ANSI_X9_24")?
                           }
@@ -366,7 +382,21 @@ module Aws
                                },
                                ?pin_data_length: ::Integer,
                                primary_account_number: ::String,
-                               pin_block_format: ("ISO_FORMAT_0" | "ISO_FORMAT_3")
+                               pin_block_format: ("ISO_FORMAT_0" | "ISO_FORMAT_3" | "ISO_FORMAT_4"),
+                               ?encryption_wrapped_key: {
+                                 wrapped_key_material: {
+                                   tr_31_key_block: ::String?,
+                                   diffie_hellman_symmetric_key: {
+                                     certificate_authority_public_key_identifier: ::String,
+                                     public_key_certificate: ::String,
+                                     key_algorithm: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256"),
+                                     key_derivation_function: ("NIST_SP800" | "ANSI_X963"),
+                                     key_derivation_hash_algorithm: ("SHA_256" | "SHA_384" | "SHA_512"),
+                                     shared_information: ::String
+                                   }?
+                                 },
+                                 key_check_value_algorithm: ("CMAC" | "ANSI_X9_24")?
+                               }
                              ) -> _GeneratePinDataResponseSuccess
                            | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _GeneratePinDataResponseSuccess
 
@@ -411,13 +441,29 @@ module Aws
                              },
                              ?incoming_wrapped_key: {
                                wrapped_key_material: {
-                                 tr_31_key_block: ::String?
+                                 tr_31_key_block: ::String?,
+                                 diffie_hellman_symmetric_key: {
+                                   certificate_authority_public_key_identifier: ::String,
+                                   public_key_certificate: ::String,
+                                   key_algorithm: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256"),
+                                   key_derivation_function: ("NIST_SP800" | "ANSI_X963"),
+                                   key_derivation_hash_algorithm: ("SHA_256" | "SHA_384" | "SHA_512"),
+                                   shared_information: ::String
+                                 }?
                                },
                                key_check_value_algorithm: ("CMAC" | "ANSI_X9_24")?
                              },
                              ?outgoing_wrapped_key: {
                                wrapped_key_material: {
-                                 tr_31_key_block: ::String?
+                                 tr_31_key_block: ::String?,
+                                 diffie_hellman_symmetric_key: {
+                                   certificate_authority_public_key_identifier: ::String,
+                                   public_key_certificate: ::String,
+                                   key_algorithm: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256"),
+                                   key_derivation_function: ("NIST_SP800" | "ANSI_X963"),
+                                   key_derivation_hash_algorithm: ("SHA_256" | "SHA_384" | "SHA_512"),
+                                   shared_information: ::String
+                                 }?
                                },
                                key_check_value_algorithm: ("CMAC" | "ANSI_X9_24")?
                              }
@@ -473,13 +519,29 @@ module Aws
                                 },
                                 ?incoming_wrapped_key: {
                                   wrapped_key_material: {
-                                    tr_31_key_block: ::String?
+                                    tr_31_key_block: ::String?,
+                                    diffie_hellman_symmetric_key: {
+                                      certificate_authority_public_key_identifier: ::String,
+                                      public_key_certificate: ::String,
+                                      key_algorithm: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256"),
+                                      key_derivation_function: ("NIST_SP800" | "ANSI_X963"),
+                                      key_derivation_hash_algorithm: ("SHA_256" | "SHA_384" | "SHA_512"),
+                                      shared_information: ::String
+                                    }?
                                   },
                                   key_check_value_algorithm: ("CMAC" | "ANSI_X9_24")?
                                 },
                                 ?outgoing_wrapped_key: {
                                   wrapped_key_material: {
-                                    tr_31_key_block: ::String?
+                                    tr_31_key_block: ::String?,
+                                    diffie_hellman_symmetric_key: {
+                                      certificate_authority_public_key_identifier: ::String,
+                                      public_key_certificate: ::String,
+                                      key_algorithm: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256"),
+                                      key_derivation_function: ("NIST_SP800" | "ANSI_X963"),
+                                      key_derivation_hash_algorithm: ("SHA_256" | "SHA_384" | "SHA_512"),
+                                      shared_information: ::String
+                                    }?
                                   },
                                   key_check_value_algorithm: ("CMAC" | "ANSI_X9_24")?
                                 }
@@ -654,11 +716,25 @@ module Aws
                              },
                              encrypted_pin_block: ::String,
                              primary_account_number: ::String,
-                             pin_block_format: ("ISO_FORMAT_0" | "ISO_FORMAT_3"),
+                             pin_block_format: ("ISO_FORMAT_0" | "ISO_FORMAT_3" | "ISO_FORMAT_4"),
                              ?pin_data_length: ::Integer,
                              ?dukpt_attributes: {
                                key_serial_number: ::String,
                                dukpt_derivation_type: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256")
+                             },
+                             ?encryption_wrapped_key: {
+                               wrapped_key_material: {
+                                 tr_31_key_block: ::String?,
+                                 diffie_hellman_symmetric_key: {
+                                   certificate_authority_public_key_identifier: ::String,
+                                   public_key_certificate: ::String,
+                                   key_algorithm: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256"),
+                                   key_derivation_function: ("NIST_SP800" | "ANSI_X963"),
+                                   key_derivation_hash_algorithm: ("SHA_256" | "SHA_384" | "SHA_512"),
+                                   shared_information: ::String
+                                 }?
+                               },
+                               key_check_value_algorithm: ("CMAC" | "ANSI_X9_24")?
                              }
                            ) -> _VerifyPinDataResponseSuccess
                          | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _VerifyPinDataResponseSuccess

data/sig/types.rbs

@@ -232,6 +232,16 @@ module Aws::PaymentCryptographyData
       SENSITIVE: [:card_expiry_date, :service_code]
     end
 
+    class EcdhDerivationAttributes
+      attr_accessor certificate_authority_public_key_identifier: ::String
+      attr_accessor public_key_certificate: ::String
+      attr_accessor key_algorithm: ("TDES_2KEY" | "TDES_3KEY" | "AES_128" | "AES_192" | "AES_256")
+      attr_accessor key_derivation_function: ("NIST_SP800" | "ANSI_X963")
+      attr_accessor key_derivation_hash_algorithm: ("SHA_256" | "SHA_384" | "SHA_512")
+      attr_accessor shared_information: ::String
+      SENSITIVE: [:public_key_certificate]
+    end
+
     class Emv2000Attributes
       attr_accessor major_key_derivation_mode: ("EMV_OPTION_A" | "EMV_OPTION_B")
       attr_accessor primary_account_number: ::String
@@ -356,7 +366,8 @@ module Aws::PaymentCryptographyData
       attr_accessor generation_attributes: Types::PinGenerationAttributes
       attr_accessor pin_data_length: ::Integer
       attr_accessor primary_account_number: ::String
-      attr_accessor pin_block_format: ("ISO_FORMAT_0" | "ISO_FORMAT_3")
+      attr_accessor pin_block_format: ("ISO_FORMAT_0" | "ISO_FORMAT_3" | "ISO_FORMAT_4")
+      attr_accessor encryption_wrapped_key: Types::WrappedKey
       SENSITIVE: [:primary_account_number]
     end
 
@@ -752,9 +763,10 @@ module Aws::PaymentCryptographyData
       attr_accessor verification_attributes: Types::PinVerificationAttributes
       attr_accessor encrypted_pin_block: ::String
       attr_accessor primary_account_number: ::String
-      attr_accessor pin_block_format: ("ISO_FORMAT_0" | "ISO_FORMAT_3")
+      attr_accessor pin_block_format: ("ISO_FORMAT_0" | "ISO_FORMAT_3" | "ISO_FORMAT_4")
       attr_accessor pin_data_length: ::Integer
       attr_accessor dukpt_attributes: Types::DukptAttributes
+      attr_accessor encryption_wrapped_key: Types::WrappedKey
       SENSITIVE: [:encrypted_pin_block, :primary_account_number]
     end
 
@@ -809,11 +821,14 @@ module Aws::PaymentCryptographyData
 
     class WrappedKeyMaterial
       attr_accessor tr_31_key_block: ::String
+      attr_accessor diffie_hellman_symmetric_key: Types::EcdhDerivationAttributes
       attr_accessor unknown: untyped
       SENSITIVE: [:tr_31_key_block]
 
       class Tr31KeyBlock < WrappedKeyMaterial
       end
+      class DiffieHellmanSymmetricKey < WrappedKeyMaterial
+      end
       class Unknown < WrappedKeyMaterial
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-paymentcryptographydata
 version: !ruby/object:Gem::Version
-  version: 1.26.0
+  version: 1.27.0
 platform: ruby
 authors:
 - Amazon Web Services
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-10-21 00:00:00.000000000 Z
+date: 2024-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core