@aws-sdk/client-payment-cryptography-data 3.525.0 → 3.529.1

package/dist-cjs/index.js

@@ -32,6 +32,9 @@ __export(src_exports, {
   DukptEncryptionAttributesFilterSensitiveLog: () => DukptEncryptionAttributesFilterSensitiveLog,
   DukptEncryptionMode: () => DukptEncryptionMode,
   DukptKeyVariant: () => DukptKeyVariant,
+  EmvEncryptionAttributesFilterSensitiveLog: () => EmvEncryptionAttributesFilterSensitiveLog,
+  EmvEncryptionMode: () => EmvEncryptionMode,
+  EmvMajorKeyDerivationMode: () => EmvMajorKeyDerivationMode,
   EncryptDataCommand: () => EncryptDataCommand,
   EncryptDataInputFilterSensitiveLog: () => EncryptDataInputFilterSensitiveLog,
   EncryptDataOutputFilterSensitiveLog: () => EncryptDataOutputFilterSensitiveLog,
@@ -357,6 +360,14 @@ var DukptEncryptionMode = {
   CBC: "CBC",
   ECB: "ECB"
 };
+var EmvMajorKeyDerivationMode = {
+  EMV_OPTION_A: "EMV_OPTION_A",
+  EMV_OPTION_B: "EMV_OPTION_B"
+};
+var EmvEncryptionMode = {
+  CBC: "CBC",
+  ECB: "ECB"
+};
 var EncryptionMode = {
   CBC: "CBC",
   CFB: "CFB",
@@ -376,6 +387,8 @@ var EncryptionDecryptionAttributes;
       return visitor.Asymmetric(value.Asymmetric);
     if (value.Dukpt !== void 0)
       return visitor.Dukpt(value.Dukpt);
+    if (value.Emv !== void 0)
+      return visitor.Emv(value.Emv);
     return visitor._(value.$unknown[0], value.$unknown[1]);
   }, "visit");
 })(EncryptionDecryptionAttributes || (EncryptionDecryptionAttributes = {}));
@@ -608,6 +621,11 @@ var DukptEncryptionAttributesFilterSensitiveLog = /* @__PURE__ */ __name((obj) =
   ...obj,
   ...obj.InitializationVector && { InitializationVector: import_smithy_client.SENSITIVE_STRING }
 }), "DukptEncryptionAttributesFilterSensitiveLog");
+var EmvEncryptionAttributesFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
+  ...obj,
+  ...obj.PrimaryAccountNumber && { PrimaryAccountNumber: import_smithy_client.SENSITIVE_STRING },
+  ...obj.InitializationVector && { InitializationVector: import_smithy_client.SENSITIVE_STRING }
+}), "EmvEncryptionAttributesFilterSensitiveLog");
 var SymmetricEncryptionAttributesFilterSensitiveLog = /* @__PURE__ */ __name((obj) => ({
   ...obj,
   ...obj.InitializationVector && { InitializationVector: import_smithy_client.SENSITIVE_STRING }
@@ -619,6 +637,8 @@ var EncryptionDecryptionAttributesFilterSensitiveLog = /* @__PURE__ */ __name((o
     return { Asymmetric: obj.Asymmetric };
   if (obj.Dukpt !== void 0)
     return { Dukpt: DukptEncryptionAttributesFilterSensitiveLog(obj.Dukpt) };
+  if (obj.Emv !== void 0)
+    return { Emv: EmvEncryptionAttributesFilterSensitiveLog(obj.Emv) };
   if (obj.$unknown !== void 0)
     return { [obj.$unknown[0]]: "UNKNOWN" };
 }, "EncryptionDecryptionAttributesFilterSensitiveLog");
@@ -1006,7 +1026,7 @@ var de_DecryptDataCommand = /* @__PURE__ */ __name(async (output, context) => {
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     KeyArn: import_smithy_client.expectString,
     KeyCheckValue: import_smithy_client.expectString,
@@ -1022,7 +1042,7 @@ var de_EncryptDataCommand = /* @__PURE__ */ __name(async (output, context) => {
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     CipherText: import_smithy_client.expectString,
     KeyArn: import_smithy_client.expectString,
@@ -1038,7 +1058,7 @@ var de_GenerateCardValidationDataCommand = /* @__PURE__ */ __name(async (output,
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     KeyArn: import_smithy_client.expectString,
     KeyCheckValue: import_smithy_client.expectString,
@@ -1054,7 +1074,7 @@ var de_GenerateMacCommand = /* @__PURE__ */ __name(async (output, context) => {
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     KeyArn: import_smithy_client.expectString,
     KeyCheckValue: import_smithy_client.expectString,
@@ -1070,7 +1090,7 @@ var de_GeneratePinDataCommand = /* @__PURE__ */ __name(async (output, context) =
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     EncryptedPinBlock: import_smithy_client.expectString,
     EncryptionKeyArn: import_smithy_client.expectString,
@@ -1089,7 +1109,7 @@ var de_ReEncryptDataCommand = /* @__PURE__ */ __name(async (output, context) =>
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     CipherText: import_smithy_client.expectString,
     KeyArn: import_smithy_client.expectString,
@@ -1105,7 +1125,7 @@ var de_TranslatePinDataCommand = /* @__PURE__ */ __name(async (output, context)
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     KeyArn: import_smithy_client.expectString,
     KeyCheckValue: import_smithy_client.expectString,
@@ -1121,7 +1141,7 @@ var de_VerifyAuthRequestCryptogramCommand = /* @__PURE__ */ __name(async (output
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     AuthResponseValue: import_smithy_client.expectString,
     KeyArn: import_smithy_client.expectString,
@@ -1137,7 +1157,7 @@ var de_VerifyCardValidationDataCommand = /* @__PURE__ */ __name(async (output, c
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     KeyArn: import_smithy_client.expectString,
     KeyCheckValue: import_smithy_client.expectString
@@ -1152,7 +1172,7 @@ var de_VerifyMacCommand = /* @__PURE__ */ __name(async (output, context) => {
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     KeyArn: import_smithy_client.expectString,
     KeyCheckValue: import_smithy_client.expectString
@@ -1167,7 +1187,7 @@ var de_VerifyPinDataCommand = /* @__PURE__ */ __name(async (output, context) =>
   const contents = (0, import_smithy_client.map)({
     $metadata: deserializeMetadata(output)
   });
-  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await parseBody(output.body, context)), "body");
+  const data = (0, import_smithy_client.expectNonNull)((0, import_smithy_client.expectObject)(await (0, import_core2.parseJsonBody)(output.body, context)), "body");
   const doc = (0, import_smithy_client.take)(data, {
     EncryptionKeyArn: import_smithy_client.expectString,
     EncryptionKeyCheckValue: import_smithy_client.expectString,
@@ -1180,9 +1200,9 @@ var de_VerifyPinDataCommand = /* @__PURE__ */ __name(async (output, context) =>
 var de_CommandError = /* @__PURE__ */ __name(async (output, context) => {
   const parsedOutput = {
     ...output,
-    body: await parseErrorBody(output.body, context)
+    body: await (0, import_core2.parseJsonErrorBody)(output.body, context)
   };
-  const errorCode = loadRestJsonErrorCode(output, parsedOutput.body);
+  const errorCode = (0, import_core2.loadRestJsonErrorCode)(output, parsedOutput.body);
   switch (errorCode) {
     case "AccessDeniedException":
     case "com.amazonaws.paymentcryptographydata#AccessDeniedException":
@@ -1298,47 +1318,6 @@ var deserializeMetadata = /* @__PURE__ */ __name((output) => ({
   extendedRequestId: output.headers["x-amz-id-2"],
   cfId: output.headers["x-amz-cf-id"]
 }), "deserializeMetadata");
-var collectBodyString = /* @__PURE__ */ __name((streamBody, context) => (0, import_smithy_client.collectBody)(streamBody, context).then((body) => context.utf8Encoder(body)), "collectBodyString");
-var parseBody = /* @__PURE__ */ __name((streamBody, context) => collectBodyString(streamBody, context).then((encoded) => {
-  if (encoded.length) {
-    return JSON.parse(encoded);
-  }
-  return {};
-}), "parseBody");
-var parseErrorBody = /* @__PURE__ */ __name(async (errorBody, context) => {
-  const value = await parseBody(errorBody, context);
-  value.message = value.message ?? value.Message;
-  return value;
-}, "parseErrorBody");
-var loadRestJsonErrorCode = /* @__PURE__ */ __name((output, data) => {
-  const findKey = /* @__PURE__ */ __name((object, key) => Object.keys(object).find((k) => k.toLowerCase() === key.toLowerCase()), "findKey");
-  const sanitizeErrorCode = /* @__PURE__ */ __name((rawValue) => {
-    let cleanValue = rawValue;
-    if (typeof cleanValue === "number") {
-      cleanValue = cleanValue.toString();
-    }
-    if (cleanValue.indexOf(",") >= 0) {
-      cleanValue = cleanValue.split(",")[0];
-    }
-    if (cleanValue.indexOf(":") >= 0) {
-      cleanValue = cleanValue.split(":")[0];
-    }
-    if (cleanValue.indexOf("#") >= 0) {
-      cleanValue = cleanValue.split("#")[1];
-    }
-    return cleanValue;
-  }, "sanitizeErrorCode");
-  const headerKey = findKey(output.headers, "x-amzn-errortype");
-  if (headerKey !== void 0) {
-    return sanitizeErrorCode(output.headers[headerKey]);
-  }
-  if (data.code !== void 0) {
-    return sanitizeErrorCode(data.code);
-  }
-  if (data["__type"] !== void 0) {
-    return sanitizeErrorCode(data["__type"]);
-  }
-}, "loadRestJsonErrorCode");
 
 // src/commands/DecryptDataCommand.ts
 var _DecryptDataCommand = class _DecryptDataCommand extends import_smithy_client.Command.classBuilder().ep({
@@ -1572,6 +1551,8 @@ var import_util_endpoints = require("@aws-sdk/util-endpoints");
   DukptDerivationType,
   DukptKeyVariant,
   DukptEncryptionMode,
+  EmvMajorKeyDerivationMode,
+  EmvEncryptionMode,
   EncryptionMode,
   EncryptionDecryptionAttributes,
   InternalServerException,
@@ -1593,6 +1574,7 @@ var import_util_endpoints = require("@aws-sdk/util-endpoints");
   SessionKeyDerivation,
   PinVerificationAttributes,
   DukptEncryptionAttributesFilterSensitiveLog,
+  EmvEncryptionAttributesFilterSensitiveLog,
   SymmetricEncryptionAttributesFilterSensitiveLog,
   EncryptionDecryptionAttributesFilterSensitiveLog,
   DecryptDataInputFilterSensitiveLog,

package/dist-es/models/models_0.js

@@ -87,6 +87,14 @@ export const DukptEncryptionMode = {
     CBC: "CBC",
     ECB: "ECB",
 };
+export const EmvMajorKeyDerivationMode = {
+    EMV_OPTION_A: "EMV_OPTION_A",
+    EMV_OPTION_B: "EMV_OPTION_B",
+};
+export const EmvEncryptionMode = {
+    CBC: "CBC",
+    ECB: "ECB",
+};
 export const EncryptionMode = {
     CBC: "CBC",
     CFB: "CFB",
@@ -106,6 +114,8 @@ export var EncryptionDecryptionAttributes;
             return visitor.Asymmetric(value.Asymmetric);
         if (value.Dukpt !== undefined)
             return visitor.Dukpt(value.Dukpt);
+        if (value.Emv !== undefined)
+            return visitor.Emv(value.Emv);
         return visitor._(value.$unknown[0], value.$unknown[1]);
     };
 })(EncryptionDecryptionAttributes || (EncryptionDecryptionAttributes = {}));
@@ -313,6 +323,11 @@ export const DukptEncryptionAttributesFilterSensitiveLog = (obj) => ({
     ...obj,
     ...(obj.InitializationVector && { InitializationVector: SENSITIVE_STRING }),
 });
+export const EmvEncryptionAttributesFilterSensitiveLog = (obj) => ({
+    ...obj,
+    ...(obj.PrimaryAccountNumber && { PrimaryAccountNumber: SENSITIVE_STRING }),
+    ...(obj.InitializationVector && { InitializationVector: SENSITIVE_STRING }),
+});
 export const SymmetricEncryptionAttributesFilterSensitiveLog = (obj) => ({
     ...obj,
     ...(obj.InitializationVector && { InitializationVector: SENSITIVE_STRING }),
@@ -324,6 +339,8 @@ export const EncryptionDecryptionAttributesFilterSensitiveLog = (obj) => {
         return { Asymmetric: obj.Asymmetric };
     if (obj.Dukpt !== undefined)
         return { Dukpt: DukptEncryptionAttributesFilterSensitiveLog(obj.Dukpt) };
+    if (obj.Emv !== undefined)
+        return { Emv: EmvEncryptionAttributesFilterSensitiveLog(obj.Emv) };
     if (obj.$unknown !== undefined)
         return { [obj.$unknown[0]]: "UNKNOWN" };
 };

package/dist-es/protocols/Aws_restJson1.js

@@ -1,4 +1,4 @@
-import { awsExpectUnion as __expectUnion } from "@aws-sdk/core";
+import { awsExpectUnion as __expectUnion, loadRestJsonErrorCode, parseJsonBody as parseBody, parseJsonErrorBody as parseErrorBody, } from "@aws-sdk/core";
 import { requestBuilder as rb } from "@smithy/core";
 import { _json, collectBody, decorateServiceException as __decorateServiceException, expectNonNull as __expectNonNull, expectObject as __expectObject, expectString as __expectString, map, take, withBaseException, } from "@smithy/smithy-client";
 import { AccessDeniedException, InternalServerException, ResourceNotFoundException, ThrottlingException, ValidationException, VerificationFailedException, } from "../models/models_0";
@@ -495,43 +495,3 @@ const isSerializableHeaderValue = (value) => value !== undefined &&
     value !== "" &&
     (!Object.getOwnPropertyNames(value).includes("length") || value.length != 0) &&
     (!Object.getOwnPropertyNames(value).includes("size") || value.size != 0);
-const parseBody = (streamBody, context) => collectBodyString(streamBody, context).then((encoded) => {
-    if (encoded.length) {
-        return JSON.parse(encoded);
-    }
-    return {};
-});
-const parseErrorBody = async (errorBody, context) => {
-    const value = await parseBody(errorBody, context);
-    value.message = value.message ?? value.Message;
-    return value;
-};
-const loadRestJsonErrorCode = (output, data) => {
-    const findKey = (object, key) => Object.keys(object).find((k) => k.toLowerCase() === key.toLowerCase());
-    const sanitizeErrorCode = (rawValue) => {
-        let cleanValue = rawValue;
-        if (typeof cleanValue === "number") {
-            cleanValue = cleanValue.toString();
-        }
-        if (cleanValue.indexOf(",") >= 0) {
-            cleanValue = cleanValue.split(",")[0];
-        }
-        if (cleanValue.indexOf(":") >= 0) {
-            cleanValue = cleanValue.split(":")[0];
-        }
-        if (cleanValue.indexOf("#") >= 0) {
-            cleanValue = cleanValue.split("#")[1];
-        }
-        return cleanValue;
-    };
-    const headerKey = findKey(output.headers, "x-amzn-errortype");
-    if (headerKey !== undefined) {
-        return sanitizeErrorCode(output.headers[headerKey]);
-    }
-    if (data.code !== undefined) {
-        return sanitizeErrorCode(data.code);
-    }
-    if (data["__type"] !== undefined) {
-        return sanitizeErrorCode(data["__type"]);
-    }
-};

package/dist-types/commands/DecryptDataCommand.d.ts

@@ -26,9 +26,10 @@ declare const DecryptDataCommand_base: {
 };
 /**
  * @public
- * <p>Decrypts ciphertext data to plaintext using symmetric, asymmetric, or DUKPT data encryption key. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/decrypt-data.html">Decrypt data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
+ * <p>Decrypts ciphertext data to plaintext using a symmetric (TDES, AES), asymmetric (RSA), or derived (DUKPT or EMV) encryption key scheme. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/decrypt-data.html">Decrypt data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
  *          <p>You can use an encryption key generated within Amazon Web Services Payment Cryptography, or you can import your own encryption key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. For this operation, the key must have <code>KeyModesOfUse</code> set to <code>Decrypt</code>. In asymmetric decryption, Amazon Web Services Payment Cryptography decrypts the ciphertext using the private component of the asymmetric encryption key pair. For data encryption outside of Amazon Web Services Payment Cryptography, you can export the public component of the asymmetric key pair by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_GetPublicKeyCertificate.html">GetPublicCertificate</a>.</p>
- *          <p>For symmetric and DUKPT decryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> algorithms. For asymmetric decryption, Amazon Web Services Payment Cryptography supports <code>RSA</code>. When you use DUKPT, for <code>TDES</code> algorithm, the ciphertext data length must be a multiple of 16 bytes. For <code>AES</code> algorithm, the ciphertext data length must be a multiple of 32 bytes.</p>
+ *          <p>For symmetric and DUKPT decryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> algorithms. For EMV decryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> algorithms. For asymmetric decryption, Amazon Web Services Payment Cryptography supports <code>RSA</code>. </p>
+ *          <p>When you use TDES or TDES DUKPT, the ciphertext data length must be a multiple of 8 bytes. For AES or AES DUKPT, the ciphertext data length must be a multiple of 16 bytes. For RSA, it sould be equal to the key size unless padding is enabled.</p>
  *          <p>For information about valid keys for this operation, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html">Understanding key attributes</a> and <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p>
  *          <p>
  *             <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p>
@@ -77,6 +78,14 @@ declare const DecryptDataCommand_base: {
  *       DukptKeyVariant: "STRING_VALUE",
  *       InitializationVector: "STRING_VALUE",
  *     },
+ *     Emv: { // EmvEncryptionAttributes
+ *       MajorKeyDerivationMode: "STRING_VALUE", // required
+ *       PrimaryAccountNumber: "STRING_VALUE", // required
+ *       PanSequenceNumber: "STRING_VALUE", // required
+ *       SessionDerivationData: "STRING_VALUE", // required
+ *       Mode: "STRING_VALUE",
+ *       InitializationVector: "STRING_VALUE",
+ *     },
  *   },
  * };
  * const command = new DecryptDataCommand(input);

package/dist-types/commands/EncryptDataCommand.d.ts

@@ -26,9 +26,11 @@ declare const EncryptDataCommand_base: {
 };
 /**
  * @public
- * <p>Encrypts plaintext data to ciphertext using symmetric, asymmetric, or DUKPT data encryption key. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/encrypt-data.html">Encrypt data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
- *          <p>You can generate an encryption key within Amazon Web Services Payment Cryptography by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html">CreateKey</a>. You can import your own encryption key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. For this operation, the key must have <code>KeyModesOfUse</code> set to <code>Encrypt</code>. In asymmetric encryption, plaintext is encrypted using public component. You can import the public component of an asymmetric key pair created outside Amazon Web Services Payment Cryptography by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>). </p>
- *          <p>for symmetric and DUKPT encryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> algorithms. For asymmetric encryption, Amazon Web Services Payment Cryptography supports <code>RSA</code>. To encrypt using DUKPT, you must already have a DUKPT key in your account with <code>KeyModesOfUse</code> set to <code>DeriveKey</code>, or you can generate a new DUKPT key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html">CreateKey</a>.</p>
+ * <p>Encrypts plaintext data to ciphertext using a symmetric (TDES, AES), asymmetric (RSA), or derived (DUKPT or EMV) encryption key scheme. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/encrypt-data.html">Encrypt data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
+ *          <p>You can generate an encryption key within Amazon Web Services Payment Cryptography by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html">CreateKey</a>. You can import your own encryption key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. For this operation, the key must have <code>KeyModesOfUse</code> set to <code>Encrypt</code>. In asymmetric encryption, plaintext is encrypted using public component. You can import the public component of an asymmetric key pair created outside Amazon Web Services Payment Cryptography by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_ImportKey.html">ImportKey</a>. </p>
+ *          <p>For symmetric and DUKPT encryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> algorithms. For EMV encryption, Amazon Web Services Payment Cryptography supports <code>TDES</code> algorithms.For asymmetric encryption, Amazon Web Services Payment Cryptography supports <code>RSA</code>. </p>
+ *          <p>When you use TDES or TDES DUKPT, the plaintext data length must be a multiple of 8 bytes. For AES or AES DUKPT, the plaintext data length must be a multiple of 16 bytes. For RSA, it sould be equal to the key size unless padding is enabled.</p>
+ *          <p>To encrypt using DUKPT, you must already have a BDK (Base Derivation Key) key in your account with <code>KeyModesOfUse</code> set to <code>DeriveKey</code>, or you can generate a new DUKPT key by calling <a href="https://docs.aws.amazon.com/payment-cryptography/latest/APIReference/API_CreateKey.html">CreateKey</a>. To encrypt using EMV, you must already have an IMK (Issuer Master Key) key in your account with <code>KeyModesOfUse</code> set to <code>DeriveKey</code>.</p>
  *          <p>For information about valid keys for this operation, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html">Understanding key attributes</a> and <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
  *          <p>
  *             <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p>
@@ -82,6 +84,14 @@ declare const EncryptDataCommand_base: {
  *       DukptKeyVariant: "STRING_VALUE",
  *       InitializationVector: "STRING_VALUE",
  *     },
+ *     Emv: { // EmvEncryptionAttributes
+ *       MajorKeyDerivationMode: "STRING_VALUE", // required
+ *       PrimaryAccountNumber: "STRING_VALUE", // required
+ *       PanSequenceNumber: "STRING_VALUE", // required
+ *       SessionDerivationData: "STRING_VALUE", // required
+ *       Mode: "STRING_VALUE",
+ *       InitializationVector: "STRING_VALUE",
+ *     },
  *   },
  * };
  * const command = new EncryptDataCommand(input);

package/dist-types/commands/GenerateMacCommand.d.ts

@@ -27,7 +27,8 @@ declare const GenerateMacCommand_base: {
 /**
  * @public
  * <p>Generates a Message Authentication Code (MAC) cryptogram within Amazon Web Services Payment Cryptography. </p>
- *          <p>You can use this operation when keys won't be shared but mutual data is present on both ends for validation. In this case, known data values are used to generate a MAC on both ends for comparision without sending or receiving data in ciphertext or plaintext. You can use this operation to generate a DUPKT, HMAC or EMV MAC by setting generation attributes and algorithm to the associated values. The MAC generation encryption key must have valid values for <code>KeyUsage</code> such as <code>TR31_M7_HMAC_KEY</code> for HMAC generation, and they key must have <code>KeyModesOfUse</code> set to <code>Generate</code> and <code>Verify</code>.</p>
+ *          <p>You can use this operation to authenticate card-related data by using known data values to generate MAC for data validation between the sending and receiving parties. This operation uses message data, a secret encryption key and MAC algorithm to generate a unique MAC value for transmission. The receiving party of the MAC must use the same message data, secret encryption key and MAC algorithm to reproduce another MAC value for comparision.</p>
+ *          <p>You can use this operation to generate a DUPKT, CMAC, HMAC or EMV MAC by setting generation attributes and algorithm to the associated values. The MAC generation encryption key must have valid values for <code>KeyUsage</code> such as <code>TR31_M7_HMAC_KEY</code> for HMAC generation, and they key must have <code>KeyModesOfUse</code> set to <code>Generate</code> and <code>Verify</code>.</p>
  *          <p>For information about valid keys for this operation, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html">Understanding key attributes</a> and <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p>
  *          <p>
  *             <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p>

package/dist-types/commands/TranslatePinDataCommand.d.ts

@@ -27,11 +27,11 @@ declare const TranslatePinDataCommand_base: {
 /**
  * @public
  * <p>Translates encrypted PIN block from and to ISO 9564 formats 0,1,3,4. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/translate-pin-data.html">Translate PIN data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
- *          <p>PIN block translation involves changing the encrytion of PIN block from one encryption key to another encryption key and changing PIN block format from one to another without PIN block data leaving Amazon Web Services Payment Cryptography. The encryption key transformation can be from PEK (Pin Encryption Key) to BDK (Base Derivation Key) for DUKPT or from BDK for DUKPT to PEK. Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> key derivation type for DUKPT tranlations. You can use this operation for P2PE (Point to Point Encryption) use cases where the encryption keys should change but the processing system either does not need to, or is not permitted to, decrypt the data.</p>
+ *          <p>PIN block translation involves changing the encrytion of PIN block from one encryption key to another encryption key and changing PIN block format from one to another without PIN block data leaving Amazon Web Services Payment Cryptography. The encryption key transformation can be from PEK (Pin Encryption Key) to BDK (Base Derivation Key) for DUKPT or from BDK for DUKPT to PEK. Amazon Web Services Payment Cryptography supports <code>TDES</code> and <code>AES</code> key derivation type for DUKPT translations. </p>
  *          <p>The allowed combinations of PIN block format translations are guided by PCI. It is important to note that not all encrypted PIN block formats (example, format 1) require PAN (Primary Account Number) as input. And as such, PIN block format that requires PAN (example, formats 0,3,4) cannot be translated to a format (format 1) that does not require a PAN for generation. </p>
  *          <p>For information about valid keys for this operation, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html">Understanding key attributes</a> and <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
  *          <note>
- *             <p>At this time, Amazon Web Services Payment Cryptography does not support translations to PIN format 4.</p>
+ *             <p>Amazon Web Services Payment Cryptography currently supports ISO PIN block 4 translation for PIN block built using legacy PAN length. That is, PAN is the right most 12 digits excluding the check digits.</p>
  *          </note>
  *          <p>
  *             <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p>

package/dist-types/commands/VerifyMacCommand.d.ts

@@ -27,7 +27,7 @@ declare const VerifyMacCommand_base: {
 /**
  * @public
  * <p>Verifies a Message Authentication Code (MAC). </p>
- *          <p>You can use this operation when keys won't be shared but mutual data is present on both ends for validation. In this case, known data values are used to generate a MAC on both ends for verification without sending or receiving data in ciphertext or plaintext. You can use this operation to verify a DUPKT, HMAC or EMV MAC by setting generation attributes and algorithm to the associated values. Use the same encryption key for MAC verification as you use for <a>GenerateMac</a>. </p>
+ *          <p>You can use this operation to verify MAC for message data authentication such as . In this operation, you must use the same message data, secret encryption key and MAC algorithm that was used to generate MAC. You can use this operation to verify a DUPKT, CMAC, HMAC or EMV MAC by setting generation attributes and algorithm to the associated values. </p>
  *          <p>For information about valid keys for this operation, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html">Understanding key attributes</a> and <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>. </p>
  *          <p>
  *             <b>Cross-account use</b>: This operation can't be used across different Amazon Web Services accounts.</p>

package/dist-types/models/models_0.d.ts

@@ -595,7 +595,7 @@ export interface DukptEncryptionAttributes {
     KeySerialNumber: string | undefined;
     /**
      * @public
-     * <p>The block cipher mode of operation. Block ciphers are designed to encrypt a block of data of fixed size, for example, 128 bits. The size of the input block is usually same as the size of the encrypted output block, while the key length can be different. A mode of operation describes how to repeatedly apply a cipher's single-block operation to securely transform amounts of data larger than a block.</p>
+     * <p>The block cipher method to use for encryption.</p>
      *          <p>The default is CBC.</p>
      */
     Mode?: DukptEncryptionMode;
@@ -612,7 +612,67 @@ export interface DukptEncryptionAttributes {
     DukptKeyVariant?: DukptKeyVariant;
     /**
      * @public
-     * <p>An input to cryptographic primitive used to provide the intial state. Typically the <code>InitializationVector</code> must have a random or psuedo-random value, but sometimes it only needs to be unpredictable or unique. If you don't provide a value, Amazon Web Services Payment Cryptography generates a random value.</p>
+     * <p>An input used to provide the intial state. If no value is provided, Amazon Web Services Payment Cryptography defaults it to zero.</p>
+     */
+    InitializationVector?: string;
+}
+/**
+ * @public
+ * @enum
+ */
+export declare const EmvMajorKeyDerivationMode: {
+    readonly EMV_OPTION_A: "EMV_OPTION_A";
+    readonly EMV_OPTION_B: "EMV_OPTION_B";
+};
+/**
+ * @public
+ */
+export type EmvMajorKeyDerivationMode = (typeof EmvMajorKeyDerivationMode)[keyof typeof EmvMajorKeyDerivationMode];
+/**
+ * @public
+ * @enum
+ */
+export declare const EmvEncryptionMode: {
+    readonly CBC: "CBC";
+    readonly ECB: "ECB";
+};
+/**
+ * @public
+ */
+export type EmvEncryptionMode = (typeof EmvEncryptionMode)[keyof typeof EmvEncryptionMode];
+/**
+ * @public
+ * <p>Parameters for plaintext encryption using EMV keys.</p>
+ */
+export interface EmvEncryptionAttributes {
+    /**
+     * @public
+     * <p>The EMV derivation mode to use for ICC master key derivation as per EMV version 4.3 book 2.</p>
+     */
+    MajorKeyDerivationMode: EmvMajorKeyDerivationMode | undefined;
+    /**
+     * @public
+     * <p>The Primary Account Number (PAN), a unique identifier for a payment credit or debit card and associates the card to a specific account holder.</p>
+     */
+    PrimaryAccountNumber: string | undefined;
+    /**
+     * @public
+     * <p>A number that identifies and differentiates payment cards with the same Primary Account Number (PAN).</p>
+     */
+    PanSequenceNumber: string | undefined;
+    /**
+     * @public
+     * <p>The derivation value used to derive the ICC session key. It is typically the application transaction counter value padded with zeros or previous ARQC value padded with zeros as per EMV version 4.3 book 2.</p>
+     */
+    SessionDerivationData: string | undefined;
+    /**
+     * @public
+     * <p>The block cipher method to use for encryption.</p>
+     */
+    Mode?: EmvEncryptionMode;
+    /**
+     * @public
+     * <p>An input used to provide the intial state. If no value is provided, Amazon Web Services Payment Cryptography defaults it to zero.</p>
      */
     InitializationVector?: string;
 }
@@ -641,12 +701,12 @@ export type EncryptionMode = (typeof EncryptionMode)[keyof typeof EncryptionMode
 export interface SymmetricEncryptionAttributes {
     /**
      * @public
-     * <p>The block cipher mode of operation. Block ciphers are designed to encrypt a block of data of fixed size (for example, 128 bits). The size of the input block is usually same as the size of the encrypted output block, while the key length can be different. A mode of operation describes how to repeatedly apply a cipher's single-block operation to securely transform amounts of data larger than a block.</p>
+     * <p>The block cipher method to use for encryption.</p>
      */
     Mode: EncryptionMode | undefined;
     /**
      * @public
-     * <p>An input to cryptographic primitive used to provide the intial state. The <code>InitializationVector</code> is typically required have a random or psuedo-random value, but sometimes it only needs to be unpredictable or unique. If a value is not provided, Amazon Web Services Payment Cryptography generates a random value.</p>
+     * <p>An input used to provide the intial state. If no value is provided, Amazon Web Services Payment Cryptography defaults it to zero.</p>
      */
     InitializationVector?: string;
     /**
@@ -659,7 +719,7 @@ export interface SymmetricEncryptionAttributes {
  * @public
  * <p>Parameters that are required to perform encryption and decryption operations.</p>
  */
-export type EncryptionDecryptionAttributes = EncryptionDecryptionAttributes.AsymmetricMember | EncryptionDecryptionAttributes.DukptMember | EncryptionDecryptionAttributes.SymmetricMember | EncryptionDecryptionAttributes.$UnknownMember;
+export type EncryptionDecryptionAttributes = EncryptionDecryptionAttributes.AsymmetricMember | EncryptionDecryptionAttributes.DukptMember | EncryptionDecryptionAttributes.EmvMember | EncryptionDecryptionAttributes.SymmetricMember | EncryptionDecryptionAttributes.$UnknownMember;
 /**
  * @public
  */
@@ -672,6 +732,7 @@ export declare namespace EncryptionDecryptionAttributes {
         Symmetric: SymmetricEncryptionAttributes;
         Asymmetric?: never;
         Dukpt?: never;
+        Emv?: never;
         $unknown?: never;
     }
     /**
@@ -682,6 +743,7 @@ export declare namespace EncryptionDecryptionAttributes {
         Symmetric?: never;
         Asymmetric: AsymmetricEncryptionAttributes;
         Dukpt?: never;
+        Emv?: never;
         $unknown?: never;
     }
     /**
@@ -692,6 +754,18 @@ export declare namespace EncryptionDecryptionAttributes {
         Symmetric?: never;
         Asymmetric?: never;
         Dukpt: DukptEncryptionAttributes;
+        Emv?: never;
+        $unknown?: never;
+    }
+    /**
+     * @public
+     * <p>Parameters for plaintext encryption using EMV keys.</p>
+     */
+    interface EmvMember {
+        Symmetric?: never;
+        Asymmetric?: never;
+        Dukpt?: never;
+        Emv: EmvEncryptionAttributes;
         $unknown?: never;
     }
     /**
@@ -701,12 +775,14 @@ export declare namespace EncryptionDecryptionAttributes {
         Symmetric?: never;
         Asymmetric?: never;
         Dukpt?: never;
+        Emv?: never;
         $unknown: [string, any];
     }
     interface Visitor<T> {
         Symmetric: (value: SymmetricEncryptionAttributes) => T;
         Asymmetric: (value: AsymmetricEncryptionAttributes) => T;
         Dukpt: (value: DukptEncryptionAttributes) => T;
+        Emv: (value: EmvEncryptionAttributes) => T;
         _: (name: string, value: any) => T;
     }
     const visit: <T>(value: EncryptionDecryptionAttributes, visitor: Visitor<T>) => T;
@@ -742,12 +818,13 @@ export interface DecryptDataOutput {
     KeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     KeyCheckValue: string | undefined;
     /**
      * @public
-     * <p>The decrypted plaintext data.</p>
+     * <p>The decrypted plaintext data in hexBinary format.</p>
      */
     PlainText: string | undefined;
 }
@@ -877,6 +954,9 @@ export interface EncryptDataInput {
     /**
      * @public
      * <p>The plaintext to be encrypted.</p>
+     *          <note>
+     *             <p>For encryption using asymmetric keys, plaintext data length is constrained by encryption key strength that you define in <code>KeyAlgorithm</code> and padding type that you define in <code>AsymmetricEncryptionAttributes</code>. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/encrypt-data.html">Encrypt data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p>
+     *          </note>
      */
     PlainText: string | undefined;
     /**
@@ -896,7 +976,8 @@ export interface EncryptDataOutput {
     KeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     KeyCheckValue?: string;
     /**
@@ -941,7 +1022,8 @@ export interface GenerateCardValidationDataOutput {
     KeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     KeyCheckValue: string | undefined;
     /**
@@ -1135,7 +1217,7 @@ export declare namespace MacAttributes {
     }
     /**
      * @public
-     * <p>Parameters that are required for MAC generation or verification using DUKPT ISO 9797 algorithm2.</p>
+     * <p>Parameters that are required for MAC generation or verification using DUKPT ISO 9797 algorithm3.</p>
      */
     interface DukptIso9797Algorithm3Member {
         Algorithm?: never;
@@ -1189,7 +1271,7 @@ export interface GenerateMacInput {
     KeyIdentifier: string | undefined;
     /**
      * @public
-     * <p>The data for which a MAC is under generation.</p>
+     * <p>The data for which a MAC is under generation. This value must be hexBinary.</p>
      */
     MessageData: string | undefined;
     /**
@@ -1214,7 +1296,8 @@ export interface GenerateMacOutput {
     KeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     KeyCheckValue: string | undefined;
     /**
@@ -1556,7 +1639,8 @@ export interface GeneratePinDataOutput {
     GenerationKeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     GenerationKeyCheckValue: string | undefined;
     /**
@@ -1566,7 +1650,8 @@ export interface GeneratePinDataOutput {
     EncryptionKeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     EncryptionKeyCheckValue: string | undefined;
     /**
@@ -1689,7 +1774,8 @@ export interface ReEncryptDataOutput {
     KeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     KeyCheckValue: string | undefined;
     /**
@@ -1803,12 +1889,12 @@ export interface TranslatePinDataInput {
     OutgoingKeyIdentifier: string | undefined;
     /**
      * @public
-     * <p>The format of the incoming PIN block data for tranlation within Amazon Web Services Payment Cryptography.</p>
+     * <p>The format of the incoming PIN block data for translation within Amazon Web Services Payment Cryptography.</p>
      */
     IncomingTranslationAttributes: TranslationIsoFormats | undefined;
     /**
      * @public
-     * <p>The format of the outgoing PIN block data after tranlation by Amazon Web Services Payment Cryptography.</p>
+     * <p>The format of the outgoing PIN block data after translation by Amazon Web Services Payment Cryptography.</p>
      */
     OutgoingTranslationAttributes: TranslationIsoFormats | undefined;
     /**
@@ -1818,7 +1904,7 @@ export interface TranslatePinDataInput {
     EncryptedPinBlock: string | undefined;
     /**
      * @public
-     * <p>The attributes and values to use for incoming DUKPT encryption key for PIN block tranlation.</p>
+     * <p>The attributes and values to use for incoming DUKPT encryption key for PIN block translation.</p>
      */
     IncomingDukptAttributes?: DukptDerivationAttributes;
     /**
@@ -1833,7 +1919,7 @@ export interface TranslatePinDataInput {
 export interface TranslatePinDataOutput {
     /**
      * @public
-     * <p>The ougoing encrypted PIN block data after tranlation.</p>
+     * <p>The outgoing encrypted PIN block data after translation.</p>
      */
     PinBlock: string | undefined;
     /**
@@ -1843,7 +1929,8 @@ export interface TranslatePinDataOutput {
     KeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     KeyCheckValue: string | undefined;
 }
@@ -2115,7 +2202,8 @@ export interface VerifyAuthRequestCryptogramOutput {
     KeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     KeyCheckValue: string | undefined;
     /**
@@ -2160,7 +2248,8 @@ export interface VerifyCardValidationDataOutput {
     KeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     KeyCheckValue: string | undefined;
 }
@@ -2175,7 +2264,7 @@ export interface VerifyMacInput {
     KeyIdentifier: string | undefined;
     /**
      * @public
-     * <p>The data on for which MAC is under verification.</p>
+     * <p>The data on for which MAC is under verification. This value must be hexBinary.</p>
      */
     MessageData: string | undefined;
     /**
@@ -2205,7 +2294,8 @@ export interface VerifyMacOutput {
     KeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     KeyCheckValue: string | undefined;
 }
@@ -2325,7 +2415,8 @@ export interface VerifyPinDataOutput {
     VerificationKeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     VerificationKeyCheckValue: string | undefined;
     /**
@@ -2335,7 +2426,8 @@ export interface VerifyPinDataOutput {
     EncryptionKeyArn: string | undefined;
     /**
      * @public
-     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed. Amazon Web Services Payment Cryptography calculates the KCV by using standard algorithms, typically by encrypting 8 or 16 bytes or "00" or "01" and then truncating the result to the first 3 bytes, or 6 hex digits, of the resulting cryptogram.</p>
+     * <p>The key check value (KCV) of the encryption key. The KCV is used to check if all parties holding a given key have the same key or to detect that a key has changed.</p>
+     *          <p>Amazon Web Services Payment Cryptography computes the KCV according to the CMAC specification.</p>
      */
     EncryptionKeyCheckValue: string | undefined;
 }
@@ -2343,6 +2435,10 @@ export interface VerifyPinDataOutput {
  * @internal
  */
 export declare const DukptEncryptionAttributesFilterSensitiveLog: (obj: DukptEncryptionAttributes) => any;
+/**
+ * @internal
+ */
+export declare const EmvEncryptionAttributesFilterSensitiveLog: (obj: EmvEncryptionAttributes) => any;
 /**
  * @internal
  */

package/dist-types/ts3.4/models/models_0.d.ts

@@ -344,6 +344,26 @@ export interface DukptEncryptionAttributes {
   DukptKeyVariant?: DukptKeyVariant;
   InitializationVector?: string;
 }
+export declare const EmvMajorKeyDerivationMode: {
+  readonly EMV_OPTION_A: "EMV_OPTION_A";
+  readonly EMV_OPTION_B: "EMV_OPTION_B";
+};
+export type EmvMajorKeyDerivationMode =
+  (typeof EmvMajorKeyDerivationMode)[keyof typeof EmvMajorKeyDerivationMode];
+export declare const EmvEncryptionMode: {
+  readonly CBC: "CBC";
+  readonly ECB: "ECB";
+};
+export type EmvEncryptionMode =
+  (typeof EmvEncryptionMode)[keyof typeof EmvEncryptionMode];
+export interface EmvEncryptionAttributes {
+  MajorKeyDerivationMode: EmvMajorKeyDerivationMode | undefined;
+  PrimaryAccountNumber: string | undefined;
+  PanSequenceNumber: string | undefined;
+  SessionDerivationData: string | undefined;
+  Mode?: EmvEncryptionMode;
+  InitializationVector?: string;
+}
 export declare const EncryptionMode: {
   readonly CBC: "CBC";
   readonly CFB: "CFB";
@@ -364,6 +384,7 @@ export interface SymmetricEncryptionAttributes {
 export type EncryptionDecryptionAttributes =
   | EncryptionDecryptionAttributes.AsymmetricMember
   | EncryptionDecryptionAttributes.DukptMember
+  | EncryptionDecryptionAttributes.EmvMember
   | EncryptionDecryptionAttributes.SymmetricMember
   | EncryptionDecryptionAttributes.$UnknownMember;
 export declare namespace EncryptionDecryptionAttributes {
@@ -371,30 +392,42 @@ export declare namespace EncryptionDecryptionAttributes {
     Symmetric: SymmetricEncryptionAttributes;
     Asymmetric?: never;
     Dukpt?: never;
+    Emv?: never;
     $unknown?: never;
   }
   interface AsymmetricMember {
     Symmetric?: never;
     Asymmetric: AsymmetricEncryptionAttributes;
     Dukpt?: never;
+    Emv?: never;
     $unknown?: never;
   }
   interface DukptMember {
     Symmetric?: never;
     Asymmetric?: never;
     Dukpt: DukptEncryptionAttributes;
+    Emv?: never;
+    $unknown?: never;
+  }
+  interface EmvMember {
+    Symmetric?: never;
+    Asymmetric?: never;
+    Dukpt?: never;
+    Emv: EmvEncryptionAttributes;
     $unknown?: never;
   }
   interface $UnknownMember {
     Symmetric?: never;
     Asymmetric?: never;
     Dukpt?: never;
+    Emv?: never;
     $unknown: [string, any];
   }
   interface Visitor<T> {
     Symmetric: (value: SymmetricEncryptionAttributes) => T;
     Asymmetric: (value: AsymmetricEncryptionAttributes) => T;
     Dukpt: (value: DukptEncryptionAttributes) => T;
+    Emv: (value: EmvEncryptionAttributes) => T;
     _: (name: string, value: any) => T;
   }
   const visit: <T>(
@@ -1085,6 +1118,9 @@ export interface VerifyPinDataOutput {
 export declare const DukptEncryptionAttributesFilterSensitiveLog: (
   obj: DukptEncryptionAttributes
 ) => any;
+export declare const EmvEncryptionAttributesFilterSensitiveLog: (
+  obj: EmvEncryptionAttributes
+) => any;
 export declare const SymmetricEncryptionAttributesFilterSensitiveLog: (
   obj: SymmetricEncryptionAttributes
 ) => any;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-payment-cryptography-data",
   "description": "AWS SDK for JavaScript Payment Cryptography Data Client for Node.js, Browser and React Native",
-  "version": "3.525.0",
+  "version": "3.529.1",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "node ../../scripts/compilation/inline client-payment-cryptography-data",
@@ -20,9 +20,9 @@
   "dependencies": {
     "@aws-crypto/sha256-browser": "3.0.0",
     "@aws-crypto/sha256-js": "3.0.0",
-    "@aws-sdk/client-sts": "3.525.0",
-    "@aws-sdk/core": "3.525.0",
-    "@aws-sdk/credential-provider-node": "3.525.0",
+    "@aws-sdk/client-sts": "3.529.1",
+    "@aws-sdk/core": "3.529.1",
+    "@aws-sdk/credential-provider-node": "3.529.1",
     "@aws-sdk/middleware-host-header": "3.523.0",
     "@aws-sdk/middleware-logger": "3.523.0",
     "@aws-sdk/middleware-recursion-detection": "3.523.0",