Skip to content

Payment Cryptography Data Plane

Description

You use the Amazon Web Services Payment Cryptography Data Plane to manage how encryption keys are used for payment-related transaction processing and associated cryptographic operations. You can encrypt, decrypt, generate, verify, and translate payment-related cryptographic operations in Amazon Web Services Payment Cryptography. For more information, see Data operations in the Amazon Web Services Payment Cryptography User Guide.

To manage your encryption keys, you use the Amazon Web Services Payment Cryptography Control Plane. You can create, import, export, share, manage, and delete keys. You can also manage Identity and Access Management (IAM) policies for keys.

Usage

paymentcryptographydataplane(
  config = list(),
  credentials = list(),
  endpoint = NULL,
  region = NULL
)

Arguments

  • config

    Optional configuration of credentials, endpoint, and/or region.

    • credentials:
      • creds:
        • access_key_id: AWS access key ID
        • secret_access_key: AWS secret access key
        • session_token: AWS temporary session token
      • profile: The name of a profile to use. If not given, then the default profile is used.
      • anonymous: Set anonymous credentials.
    • endpoint: The complete URL to use for the constructed client.
    • region: The AWS Region used in instantiating the client.
    • close_connection: Immediately close all HTTP connections.
    • timeout: The time in seconds till a timeout exception is thrown when attempting to make a connection. The default is 60 seconds.
    • s3_force_path_style: Set this to true to force the request to use path-style addressing, i.e. http://s3.amazonaws.com/BUCKET/KEY.
    • sts_regional_endpoint: Set sts regional endpoint resolver to regional or legacy https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
    • use_dual_stack: Set this to true to use the dualstack (IPv4 and IPv6) endpoint for a service, where available, falling back to the regular endpoint when it isn't. Defaults to the AWS_USE_DUALSTACK_ENDPOINT environment variable when unset.
  • credentials

    Optional credentials shorthand for the config parameter

    • creds:
      • access_key_id: AWS access key ID
      • secret_access_key: AWS secret access key
      • session_token: AWS temporary session token
    • profile: The name of a profile to use. If not given, then the default profile is used.
    • anonymous: Set anonymous credentials.
  • endpoint

    Optional shorthand for complete URL to use for the constructed client.

  • region

    Optional shorthand for AWS Region used in instantiating the client.

Value

A client for the service. You can call the service's operations using syntax like svc$operation(...), where svc is the name you've assigned to the client. The available operations are listed in the Operations section.

Service syntax

svc <- paymentcryptographydataplane(
  config = list(
    credentials = list(
      creds = list(
        access_key_id = "string",
        secret_access_key = "string",
        session_token = "string"
      ),
      profile = "string",
      anonymous = "logical"
    ),
    endpoint = "string",
    region = "string",
    close_connection = "logical",
    timeout = "numeric",
    s3_force_path_style = "logical",
    sts_regional_endpoint = "string",
    use_dual_stack = "logical"
  ),
  credentials = list(
    creds = list(
      access_key_id = "string",
      secret_access_key = "string",
      session_token = "string"
    ),
    profile = "string",
    anonymous = "logical"
  ),
  endpoint = "string",
  region = "string"
)

Operations

decrypt_data Decrypts ciphertext data to plaintext using a symmetric (TDES, AES), asymmetric (RSA), or derived (DUKPT or EMV) encryption key scheme
encrypt_data Encrypts plaintext data to ciphertext using a symmetric (TDES, AES), asymmetric (RSA), or derived (DUKPT or EMV) encryption key scheme
generate_as_2805_kek_validation Generates a KekValidationRequest or a KekValidationResponse for node-to-node initialization between payment processing nodes using Australian Standard 2805 (AS2805)
generate_auth_request_cryptogram Generates an Authorization Request Cryptogram (ARQC) for an EMV chip payment card authorization
generate_card_validation_data Generates card-related validation data using algorithms such as Card Verification Values (CVV/CVV2), Dynamic Card Verification Values (dCVV/dCVV2), or Card Security Codes (CSC)
generate_mac Generates a Message Authentication Code (MAC) cryptogram within Amazon Web Services Payment Cryptography
generate_mac_emv_pin_change Generates an issuer script mac for EMV payment cards that use offline PINs as the cardholder verification method (CVM)
generate_pin_data Generates pin-related data such as PIN, PIN Verification Value (PVV), PIN Block, and PIN Offset during new card issuance or reissuance
re_encrypt_data Re-encrypts ciphertext using DUKPT, symmetric, or asymmetric data encryption keys
translate_key_material Translates an cryptographic key between different wrapping keys without importing the key into Amazon Web Services Payment Cryptography
translate_pin_data Translates encrypted PIN block from and to ISO 9564 formats 0,1,3,4
verify_auth_request_cryptogram Verifies Authorization Request Cryptogram (ARQC) for a EMV chip payment card authorization
verify_card_validation_data Verifies card-related validation data using algorithms such as Card Verification Values (CVV/CVV2), Dynamic Card Verification Values (dCVV/dCVV2) and Card Security Codes (CSC)
verify_mac Verifies a Message Authentication Code (MAC)
verify_pin_data Verifies pin-related data such as PIN and PIN Offset using algorithms including VISA PVV and IBM3624

Examples

svc <- paymentcryptographydataplane()
svc$decrypt_data(
  Foo = 123
)