Class: AWS.PaymentCryptography

var params = {
  Exportable: true || false, /* required */
  KeyAttributes: { /* required */
    KeyAlgorithm: TDES_2KEY | TDES_3KEY | AES_128 | AES_192 | AES_256 | RSA_2048 | RSA_3072 | RSA_4096, /* required */
    KeyClass: SYMMETRIC_KEY | ASYMMETRIC_KEY_PAIR | PRIVATE_KEY | PUBLIC_KEY, /* required */
    KeyModesOfUse: { /* required */
      Decrypt: true || false,
      DeriveKey: true || false,
      Encrypt: true || false,
      Generate: true || false,
      NoRestrictions: true || false,
      Sign: true || false,
      Unwrap: true || false,
      Verify: true || false,
      Wrap: true || false
    },
    KeyUsage: TR31_B0_BASE_DERIVATION_KEY | TR31_C0_CARD_VERIFICATION_KEY | TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY | TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION | TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS | TR31_E1_EMV_MKEY_CONFIDENTIALITY | TR31_E2_EMV_MKEY_INTEGRITY | TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS | TR31_E5_EMV_MKEY_CARD_PERSONALIZATION | TR31_E6_EMV_MKEY_OTHER | TR31_K0_KEY_ENCRYPTION_KEY | TR31_K1_KEY_BLOCK_PROTECTION_KEY | TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT | TR31_M3_ISO_9797_3_MAC_KEY | TR31_M1_ISO_9797_1_MAC_KEY | TR31_M6_ISO_9797_5_CMAC_KEY | TR31_M7_HMAC_KEY | TR31_P0_PIN_ENCRYPTION_KEY | TR31_P1_PIN_GENERATION_KEY | TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE | TR31_V1_IBM3624_PIN_VERIFICATION_KEY | TR31_V2_VISA_PIN_VERIFICATION_KEY | TR31_K2_TR34_ASYMMETRIC_KEY /* required */
  },
  Enabled: true || false,
  KeyCheckValueAlgorithm: CMAC | ANSI_X9_24,
  Tags: [
    {
      Key: 'STRING_VALUE', /* required */
      Value: 'STRING_VALUE'
    },
    /* more items */
  ]
};
paymentcryptography.createKey(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyAttributes — (map)

    The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

    • KeyUsage — required — (String)

      The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

      Possible values include:
      • "TR31_B0_BASE_DERIVATION_KEY"
      • "TR31_C0_CARD_VERIFICATION_KEY"
      • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
      • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
      • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
      • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
      • "TR31_E2_EMV_MKEY_INTEGRITY"
      • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
      • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
      • "TR31_E6_EMV_MKEY_OTHER"
      • "TR31_K0_KEY_ENCRYPTION_KEY"
      • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
      • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
      • "TR31_M3_ISO_9797_3_MAC_KEY"
      • "TR31_M1_ISO_9797_1_MAC_KEY"
      • "TR31_M6_ISO_9797_5_CMAC_KEY"
      • "TR31_M7_HMAC_KEY"
      • "TR31_P0_PIN_ENCRYPTION_KEY"
      • "TR31_P1_PIN_GENERATION_KEY"
      • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
      • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
      • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
      • "TR31_K2_TR34_ASYMMETRIC_KEY"
    • KeyClass — required — (String)

      The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

      Possible values include:
      • "SYMMETRIC_KEY"
      • "ASYMMETRIC_KEY_PAIR"
      • "PRIVATE_KEY"
      • "PUBLIC_KEY"
    • KeyAlgorithm — required — (String)

      The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

      For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

      Possible values include:
      • "TDES_2KEY"
      • "TDES_3KEY"
      • "AES_128"
      • "AES_192"
      • "AES_256"
      • "RSA_2048"
      • "RSA_3072"
      • "RSA_4096"
    • KeyModesOfUse — required — (map)

      The list of cryptographic operations that you can perform using the key.

      • Encrypt — (Boolean)

        Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

      • Decrypt — (Boolean)

        Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

      • Wrap — (Boolean)

        Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

      • Unwrap — (Boolean)

        Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

      • Generate — (Boolean)

        Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

      • Sign — (Boolean)

        Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

      • Verify — (Boolean)

        Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

      • DeriveKey — (Boolean)

        Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

      • NoRestrictions — (Boolean)

        Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

  • KeyCheckValueAlgorithm — (String)

    The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

    For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

    Possible values include:
    • "CMAC"
    • "ANSI_X9_24"
  • Exportable — (Boolean)

    Specifies whether the key is exportable from the service.

  • Enabled — (Boolean)

    Specifies whether to enable the key. If the key is enabled, it is activated for use within the service. If the key is not enabled, then it is created but not activated. The default value is enabled.

  • Tags — (Array<map>)

    Assigns one or more tags to the Amazon Web Services Payment Cryptography key. Use this parameter to tag a key when it is created. To tag an existing Amazon Web Services Payment Cryptography key, use the TagResource operation.

    Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You can't have more than one tag on an Amazon Web Services Payment Cryptography key with the same tag key.

    Don't include personal, confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.

    Note: Tagging or untagging an Amazon Web Services Payment Cryptography key can allow or deny permission to the key.
    • Key — required — (String)

      The key of the tag.

    • Value — (String)

      The value of the tag.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Key — (map)

      The key material that contains all the key attributes.

      • KeyArn — required — (String)

        The Amazon Resource Name (ARN) of the key.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • KeyCheckValue — required — (String)

        The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.

      • KeyCheckValueAlgorithm — required — (String)

        The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

        For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

        Possible values include:
        • "CMAC"
        • "ANSI_X9_24"
      • Enabled — required — (Boolean)

        Specifies whether the key is enabled.

      • Exportable — required — (Boolean)

        Specifies whether the key is exportable. This data is immutable after the key is created.

      • KeyState — required — (String)

        The state of key that is being created or deleted.

        Possible values include:
        • "CREATE_IN_PROGRESS"
        • "CREATE_COMPLETE"
        • "DELETE_PENDING"
        • "DELETE_COMPLETE"
      • KeyOrigin — required — (String)

        The source of the key material. For keys created within Amazon Web Services Payment Cryptography, the value is AWS_PAYMENT_CRYPTOGRAPHY. For keys imported into Amazon Web Services Payment Cryptography, the value is EXTERNAL.

        Possible values include:
        • "EXTERNAL"
        • "AWS_PAYMENT_CRYPTOGRAPHY"
      • CreateTimestamp — required — (Date)

        The date and time when the key was created.

      • UsageStartTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will start using the key material for cryptographic operations.

      • UsageStopTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will stop using the key material for cryptographic operations.

      • DeletePendingTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when KeyState is DELETE_PENDING and the key is scheduled for deletion.

      • DeleteTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when when the KeyState is DELETE_COMPLETE and the Amazon Web Services Payment Cryptography key is deleted.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  AliasName: 'STRING_VALUE' /* required */
};
paymentcryptography.deleteAlias(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • AliasName — (String)

    A friendly name that you can use to refer Amazon Web Services Payment Cryptography key. This value must begin with alias/ followed by a name, such as alias/ExampleAlias.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyIdentifier: 'STRING_VALUE', /* required */
  DeleteKeyInDays: 'NUMBER_VALUE'
};
paymentcryptography.deleteKey(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyIdentifier — (String)

    The KeyARN of the key that is scheduled for deletion.

  • DeleteKeyInDays — (Integer)

    The waiting period for key deletion. The default value is seven days.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Key — (map)

      The KeyARN of the key that is scheduled for deletion.

      • KeyArn — required — (String)

        The Amazon Resource Name (ARN) of the key.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • KeyCheckValue — required — (String)

        The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.

      • KeyCheckValueAlgorithm — required — (String)

        The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

        For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

        Possible values include:
        • "CMAC"
        • "ANSI_X9_24"
      • Enabled — required — (Boolean)

        Specifies whether the key is enabled.

      • Exportable — required — (Boolean)

        Specifies whether the key is exportable. This data is immutable after the key is created.

      • KeyState — required — (String)

        The state of key that is being created or deleted.

        Possible values include:
        • "CREATE_IN_PROGRESS"
        • "CREATE_COMPLETE"
        • "DELETE_PENDING"
        • "DELETE_COMPLETE"
      • KeyOrigin — required — (String)

        The source of the key material. For keys created within Amazon Web Services Payment Cryptography, the value is AWS_PAYMENT_CRYPTOGRAPHY. For keys imported into Amazon Web Services Payment Cryptography, the value is EXTERNAL.

        Possible values include:
        • "EXTERNAL"
        • "AWS_PAYMENT_CRYPTOGRAPHY"
      • CreateTimestamp — required — (Date)

        The date and time when the key was created.

      • UsageStartTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will start using the key material for cryptographic operations.

      • UsageStopTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will stop using the key material for cryptographic operations.

      • DeletePendingTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when KeyState is DELETE_PENDING and the key is scheduled for deletion.

      • DeleteTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when when the KeyState is DELETE_COMPLETE and the Amazon Web Services Payment Cryptography key is deleted.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  ExportKeyIdentifier: 'STRING_VALUE', /* required */
  KeyMaterial: { /* required */
    KeyCryptogram: {
      CertificateAuthorityPublicKeyIdentifier: 'STRING_VALUE', /* required */
      WrappingKeyCertificate: 'STRING_VALUE', /* required */
      WrappingSpec: RSA_OAEP_SHA_256 | RSA_OAEP_SHA_512
    },
    Tr31KeyBlock: {
      WrappingKeyIdentifier: 'STRING_VALUE', /* required */
      KeyBlockHeaders: {
        KeyExportability: EXPORTABLE | NON_EXPORTABLE | SENSITIVE,
        KeyModesOfUse: {
          Decrypt: true || false,
          DeriveKey: true || false,
          Encrypt: true || false,
          Generate: true || false,
          NoRestrictions: true || false,
          Sign: true || false,
          Unwrap: true || false,
          Verify: true || false,
          Wrap: true || false
        },
        KeyVersion: 'STRING_VALUE',
        OptionalBlocks: {
          '<OptionalBlockId>': 'STRING_VALUE',
          /* '<OptionalBlockId>': ... */
        }
      }
    },
    Tr34KeyBlock: {
      CertificateAuthorityPublicKeyIdentifier: 'STRING_VALUE', /* required */
      ExportToken: 'STRING_VALUE', /* required */
      KeyBlockFormat: X9_TR34_2012, /* required */
      WrappingKeyCertificate: 'STRING_VALUE', /* required */
      KeyBlockHeaders: {
        KeyExportability: EXPORTABLE | NON_EXPORTABLE | SENSITIVE,
        KeyModesOfUse: {
          Decrypt: true || false,
          DeriveKey: true || false,
          Encrypt: true || false,
          Generate: true || false,
          NoRestrictions: true || false,
          Sign: true || false,
          Unwrap: true || false,
          Verify: true || false,
          Wrap: true || false
        },
        KeyVersion: 'STRING_VALUE',
        OptionalBlocks: {
          '<OptionalBlockId>': 'STRING_VALUE',
          /* '<OptionalBlockId>': ... */
        }
      },
      RandomNonce: 'STRING_VALUE'
    }
  },
  ExportAttributes: {
    ExportDukptInitialKey: {
      KeySerialNumber: 'STRING_VALUE' /* required */
    },
    KeyCheckValueAlgorithm: CMAC | ANSI_X9_24
  }
};
paymentcryptography.exportKey(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyMaterial — (map)

    The key block format type, for example, TR-34 or TR-31, to use during key material export.

    • Tr31KeyBlock — (map)

      Parameter information for key material export using symmetric TR-31 key exchange method.

      • WrappingKeyIdentifier — required — (String)

        The KeyARN of the the wrapping key. This key encrypts or wraps the key under export for TR-31 key block generation.

      • KeyBlockHeaders — (map)

        Optional metadata for export associated with the key material. This data is signed but transmitted in clear text.

        • KeyModesOfUse — (map)

          The list of cryptographic operations that you can perform using the key. The modes of use are defined in section A.5.3 of the TR-31 spec.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

        • KeyExportability — (String)

          Specifies subsequent exportability of the key within the key block after it is received by the receiving party. It can be used to further restrict exportability of the key after export from Amazon Web Services Payment Cryptography.

          When set to EXPORTABLE, the key can be subsequently exported by the receiver under a KEK using TR-31 or TR-34 key block export only. When set to NON_EXPORTABLE, the key cannot be subsequently exported by the receiver. When set to SENSITIVE, the key can be exported by the receiver under a KEK using TR-31, TR-34, RSA wrap and unwrap cryptogram or using a symmetric cryptogram key export method. For further information refer to ANSI X9.143-2022.

          Possible values include:
          • "EXPORTABLE"
          • "NON_EXPORTABLE"
          • "SENSITIVE"
        • KeyVersion — (String)

          Parameter used to indicate the version of the key carried in the key block or indicate the value carried in the key block is a component of a key.

        • OptionalBlocks — (map<String>)

          Parameter used to indicate the type of optional data in key block headers. Refer to ANSI X9.143-2022 for information on allowed data type for optional blocks.

          Optional block character limit is 112 characters. For each optional block, 2 characters are reserved for optional block ID and 2 characters reserved for optional block length. More than one optional blocks can be included as long as the combined length does not increase 112 characters.

    • Tr34KeyBlock — (map)

      Parameter information for key material export using the asymmetric TR-34 key exchange method.

      • CertificateAuthorityPublicKeyIdentifier — required — (String)

        The KeyARN of the certificate chain that signs the wrapping key certificate during TR-34 key export.

      • WrappingKeyCertificate — required — (String)

        The KeyARN of the wrapping key certificate. Amazon Web Services Payment Cryptography uses this certificate to wrap the key under export.

      • ExportToken — required — (String)

        The export token to initiate key export from Amazon Web Services Payment Cryptography. It also contains the signing key certificate that will sign the wrapped key during TR-34 key block generation. Call GetParametersForExport to receive an export token. It expires after 7 days. You can use the same export token to export multiple keys from the same service account.

      • KeyBlockFormat — required — (String)

        The format of key block that Amazon Web Services Payment Cryptography will use during key export.

        Possible values include:
        • "X9_TR34_2012"
      • RandomNonce — (String)

        A random number value that is unique to the TR-34 key block generated using 2 pass. The operation will fail, if a random nonce value is not provided for a TR-34 key block generated using 2 pass.

      • KeyBlockHeaders — (map)

        Optional metadata for export associated with the key material. This data is signed but transmitted in clear text.

        • KeyModesOfUse — (map)

          The list of cryptographic operations that you can perform using the key. The modes of use are defined in section A.5.3 of the TR-31 spec.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

        • KeyExportability — (String)

          Specifies subsequent exportability of the key within the key block after it is received by the receiving party. It can be used to further restrict exportability of the key after export from Amazon Web Services Payment Cryptography.

          When set to EXPORTABLE, the key can be subsequently exported by the receiver under a KEK using TR-31 or TR-34 key block export only. When set to NON_EXPORTABLE, the key cannot be subsequently exported by the receiver. When set to SENSITIVE, the key can be exported by the receiver under a KEK using TR-31, TR-34, RSA wrap and unwrap cryptogram or using a symmetric cryptogram key export method. For further information refer to ANSI X9.143-2022.

          Possible values include:
          • "EXPORTABLE"
          • "NON_EXPORTABLE"
          • "SENSITIVE"
        • KeyVersion — (String)

          Parameter used to indicate the version of the key carried in the key block or indicate the value carried in the key block is a component of a key.

        • OptionalBlocks — (map<String>)

          Parameter used to indicate the type of optional data in key block headers. Refer to ANSI X9.143-2022 for information on allowed data type for optional blocks.

          Optional block character limit is 112 characters. For each optional block, 2 characters are reserved for optional block ID and 2 characters reserved for optional block length. More than one optional blocks can be included as long as the combined length does not increase 112 characters.

    • KeyCryptogram — (map)

      Parameter information for key material export using asymmetric RSA wrap and unwrap key exchange method

      • CertificateAuthorityPublicKeyIdentifier — required — (String)

        The KeyARN of the certificate chain that signs the wrapping key certificate during RSA wrap and unwrap key export.

      • WrappingKeyCertificate — required — (String)

        The wrapping key certificate in PEM format (base64 encoded). Amazon Web Services Payment Cryptography uses this certificate to wrap the key under export.

      • WrappingSpec — (String)

        The wrapping spec for the key under export.

        Possible values include:
        • "RSA_OAEP_SHA_256"
        • "RSA_OAEP_SHA_512"
  • ExportKeyIdentifier — (String)

    The KeyARN of the key under export from Amazon Web Services Payment Cryptography.

  • ExportAttributes — (map)

    The attributes for IPEK generation during export.

    • ExportDukptInitialKey — (map)

      Parameter information for IPEK export.

      • KeySerialNumber — required — (String)

        The KSN for IPEK generation using DUKPT.

        KSN must be padded before sending to Amazon Web Services Payment Cryptography. KSN hex length should be 20 for a TDES_2KEY key or 24 for an AES key.

    • KeyCheckValueAlgorithm — (String)

      The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity. Specify KCV for IPEK export only.

      For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

      Possible values include:
      • "CMAC"
      • "ANSI_X9_24"

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • WrappedKey — (map)

      The key material under export as a TR-34 WrappedKeyBlock or a TR-31 WrappedKeyBlock. or a RSA WrappedKeyCryptogram.

      • WrappingKeyArn — required — (String)

        The KeyARN of the wrapped key.

      • WrappedKeyMaterialFormat — required — (String)

        The key block format of a wrapped key.

        Possible values include:
        • "KEY_CRYPTOGRAM"
        • "TR31_KEY_BLOCK"
        • "TR34_KEY_BLOCK"
      • KeyMaterial — required — (String)

        Parameter information for generating a wrapped key using TR-31 or TR-34 skey exchange method.

      • KeyCheckValue — (String)

        The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.

      • KeyCheckValueAlgorithm — (String)

        The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

        For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

        Possible values include:
        • "CMAC"
        • "ANSI_X9_24"

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  AliasName: 'STRING_VALUE' /* required */
};
paymentcryptography.getAlias(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • AliasName — (String)

    The alias of the Amazon Web Services Payment Cryptography key.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Alias — (map)

      The alias of the Amazon Web Services Payment Cryptography key.

      • AliasName — required — (String)

        A friendly name that you can use to refer to a key. The value must begin with alias/.

        Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.

      • KeyArn — (String)

        The KeyARN of the key associated with the alias.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyIdentifier: 'STRING_VALUE' /* required */
};
paymentcryptography.getKey(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyIdentifier — (String)

    The KeyARN of the Amazon Web Services Payment Cryptography key.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Key — (map)

      The key material, including the immutable and mutable data for the key.

      • KeyArn — required — (String)

        The Amazon Resource Name (ARN) of the key.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • KeyCheckValue — required — (String)

        The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.

      • KeyCheckValueAlgorithm — required — (String)

        The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

        For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

        Possible values include:
        • "CMAC"
        • "ANSI_X9_24"
      • Enabled — required — (Boolean)

        Specifies whether the key is enabled.

      • Exportable — required — (Boolean)

        Specifies whether the key is exportable. This data is immutable after the key is created.

      • KeyState — required — (String)

        The state of key that is being created or deleted.

        Possible values include:
        • "CREATE_IN_PROGRESS"
        • "CREATE_COMPLETE"
        • "DELETE_PENDING"
        • "DELETE_COMPLETE"
      • KeyOrigin — required — (String)

        The source of the key material. For keys created within Amazon Web Services Payment Cryptography, the value is AWS_PAYMENT_CRYPTOGRAPHY. For keys imported into Amazon Web Services Payment Cryptography, the value is EXTERNAL.

        Possible values include:
        • "EXTERNAL"
        • "AWS_PAYMENT_CRYPTOGRAPHY"
      • CreateTimestamp — required — (Date)

        The date and time when the key was created.

      • UsageStartTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will start using the key material for cryptographic operations.

      • UsageStopTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will stop using the key material for cryptographic operations.

      • DeletePendingTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when KeyState is DELETE_PENDING and the key is scheduled for deletion.

      • DeleteTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when when the KeyState is DELETE_COMPLETE and the Amazon Web Services Payment Cryptography key is deleted.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyMaterialType: TR34_KEY_BLOCK | TR31_KEY_BLOCK | ROOT_PUBLIC_KEY_CERTIFICATE | TRUSTED_PUBLIC_KEY_CERTIFICATE | KEY_CRYPTOGRAM, /* required */
  SigningKeyAlgorithm: TDES_2KEY | TDES_3KEY | AES_128 | AES_192 | AES_256 | RSA_2048 | RSA_3072 | RSA_4096 /* required */
};
paymentcryptography.getParametersForExport(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyMaterialType — (String)

    The key block format type (for example, TR-34 or TR-31) to use during key material export. Export token is only required for a TR-34 key export, TR34_KEY_BLOCK. Export token is not required for TR-31 key export.

    Possible values include:
    • "TR34_KEY_BLOCK"
    • "TR31_KEY_BLOCK"
    • "ROOT_PUBLIC_KEY_CERTIFICATE"
    • "TRUSTED_PUBLIC_KEY_CERTIFICATE"
    • "KEY_CRYPTOGRAM"
  • SigningKeyAlgorithm — (String)

    The signing key algorithm to generate a signing key certificate. This certificate signs the wrapped key under export within the TR-34 key block. RSA_2048 is the only signing key algorithm allowed.

    Possible values include:
    • "TDES_2KEY"
    • "TDES_3KEY"
    • "AES_128"
    • "AES_192"
    • "AES_256"
    • "RSA_2048"
    • "RSA_3072"
    • "RSA_4096"

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • SigningKeyCertificate — (String)

      The signing key certificate in PEM format (base64 encoded) of the public key for signature within the TR-34 key block. The certificate expires after 7 days.

    • SigningKeyCertificateChain — (String)

      The root certificate authority (CA) that signed the signing key certificate in PEM format (base64 encoded).

    • SigningKeyAlgorithm — (String)

      The algorithm of the signing key certificate for use in TR-34 key block generation. RSA_2048 is the only signing key algorithm allowed.

      Possible values include:
      • "TDES_2KEY"
      • "TDES_3KEY"
      • "AES_128"
      • "AES_192"
      • "AES_256"
      • "RSA_2048"
      • "RSA_3072"
      • "RSA_4096"
    • ExportToken — (String)

      The export token to initiate key export from Amazon Web Services Payment Cryptography. The export token expires after 7 days. You can use the same export token to export multiple keys from the same service account.

    • ParametersValidUntilTimestamp — (Date)

      The validity period of the export token.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyMaterialType: TR34_KEY_BLOCK | TR31_KEY_BLOCK | ROOT_PUBLIC_KEY_CERTIFICATE | TRUSTED_PUBLIC_KEY_CERTIFICATE | KEY_CRYPTOGRAM, /* required */
  WrappingKeyAlgorithm: TDES_2KEY | TDES_3KEY | AES_128 | AES_192 | AES_256 | RSA_2048 | RSA_3072 | RSA_4096 /* required */
};
paymentcryptography.getParametersForImport(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyMaterialType — (String)

    The method to use for key material import. Import token is only required for TR-34 WrappedKeyBlock (TR34_KEY_BLOCK) and RSA WrappedKeyCryptogram (KEY_CRYPTOGRAM).

    Import token is not required for TR-31, root public key cerificate or trusted public key certificate.

    Possible values include:
    • "TR34_KEY_BLOCK"
    • "TR31_KEY_BLOCK"
    • "ROOT_PUBLIC_KEY_CERTIFICATE"
    • "TRUSTED_PUBLIC_KEY_CERTIFICATE"
    • "KEY_CRYPTOGRAM"
  • WrappingKeyAlgorithm — (String)

    The wrapping key algorithm to generate a wrapping key certificate. This certificate wraps the key under import.

    At this time, RSA_2048 is the allowed algorithm for TR-34 WrappedKeyBlock import. Additionally, RSA_2048, RSA_3072, RSA_4096 are the allowed algorithms for RSA WrappedKeyCryptogram import.

    Possible values include:
    • "TDES_2KEY"
    • "TDES_3KEY"
    • "AES_128"
    • "AES_192"
    • "AES_256"
    • "RSA_2048"
    • "RSA_3072"
    • "RSA_4096"

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • WrappingKeyCertificate — (String)

      The wrapping key certificate in PEM format (base64 encoded) of the wrapping key for use within the TR-34 key block. The certificate expires in 7 days.

    • WrappingKeyCertificateChain — (String)

      The Amazon Web Services Payment Cryptography root certificate authority (CA) that signed the wrapping key certificate in PEM format (base64 encoded).

    • WrappingKeyAlgorithm — (String)

      The algorithm of the wrapping key for use within TR-34 WrappedKeyBlock or RSA WrappedKeyCryptogram.

      Possible values include:
      • "TDES_2KEY"
      • "TDES_3KEY"
      • "AES_128"
      • "AES_192"
      • "AES_256"
      • "RSA_2048"
      • "RSA_3072"
      • "RSA_4096"
    • ImportToken — (String)

      The import token to initiate key import into Amazon Web Services Payment Cryptography. The import token expires after 7 days. You can use the same import token to import multiple keys to the same service account.

    • ParametersValidUntilTimestamp — (Date)

      The validity period of the import token.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyIdentifier: 'STRING_VALUE' /* required */
};
paymentcryptography.getPublicKeyCertificate(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyIdentifier — (String)

    The KeyARN of the asymmetric key pair.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • KeyCertificate — (String)

      The public key component of the asymmetric key pair in a certificate PEM format (base64 encoded). It is signed by the root certificate authority (CA). The certificate expires in 90 days.

    • KeyCertificateChain — (String)

      The root certificate authority (CA) that signed the public key certificate in PEM format (base64 encoded) of the asymmetric key pair.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyMaterial: { /* required */
    KeyCryptogram: {
      Exportable: true || false, /* required */
      ImportToken: 'STRING_VALUE', /* required */
      KeyAttributes: { /* required */
        KeyAlgorithm: TDES_2KEY | TDES_3KEY | AES_128 | AES_192 | AES_256 | RSA_2048 | RSA_3072 | RSA_4096, /* required */
        KeyClass: SYMMETRIC_KEY | ASYMMETRIC_KEY_PAIR | PRIVATE_KEY | PUBLIC_KEY, /* required */
        KeyModesOfUse: { /* required */
          Decrypt: true || false,
          DeriveKey: true || false,
          Encrypt: true || false,
          Generate: true || false,
          NoRestrictions: true || false,
          Sign: true || false,
          Unwrap: true || false,
          Verify: true || false,
          Wrap: true || false
        },
        KeyUsage: TR31_B0_BASE_DERIVATION_KEY | TR31_C0_CARD_VERIFICATION_KEY | TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY | TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION | TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS | TR31_E1_EMV_MKEY_CONFIDENTIALITY | TR31_E2_EMV_MKEY_INTEGRITY | TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS | TR31_E5_EMV_MKEY_CARD_PERSONALIZATION | TR31_E6_EMV_MKEY_OTHER | TR31_K0_KEY_ENCRYPTION_KEY | TR31_K1_KEY_BLOCK_PROTECTION_KEY | TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT | TR31_M3_ISO_9797_3_MAC_KEY | TR31_M1_ISO_9797_1_MAC_KEY | TR31_M6_ISO_9797_5_CMAC_KEY | TR31_M7_HMAC_KEY | TR31_P0_PIN_ENCRYPTION_KEY | TR31_P1_PIN_GENERATION_KEY | TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE | TR31_V1_IBM3624_PIN_VERIFICATION_KEY | TR31_V2_VISA_PIN_VERIFICATION_KEY | TR31_K2_TR34_ASYMMETRIC_KEY /* required */
      },
      WrappedKeyCryptogram: 'STRING_VALUE', /* required */
      WrappingSpec: RSA_OAEP_SHA_256 | RSA_OAEP_SHA_512
    },
    RootCertificatePublicKey: {
      KeyAttributes: { /* required */
        KeyAlgorithm: TDES_2KEY | TDES_3KEY | AES_128 | AES_192 | AES_256 | RSA_2048 | RSA_3072 | RSA_4096, /* required */
        KeyClass: SYMMETRIC_KEY | ASYMMETRIC_KEY_PAIR | PRIVATE_KEY | PUBLIC_KEY, /* required */
        KeyModesOfUse: { /* required */
          Decrypt: true || false,
          DeriveKey: true || false,
          Encrypt: true || false,
          Generate: true || false,
          NoRestrictions: true || false,
          Sign: true || false,
          Unwrap: true || false,
          Verify: true || false,
          Wrap: true || false
        },
        KeyUsage: TR31_B0_BASE_DERIVATION_KEY | TR31_C0_CARD_VERIFICATION_KEY | TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY | TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION | TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS | TR31_E1_EMV_MKEY_CONFIDENTIALITY | TR31_E2_EMV_MKEY_INTEGRITY | TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS | TR31_E5_EMV_MKEY_CARD_PERSONALIZATION | TR31_E6_EMV_MKEY_OTHER | TR31_K0_KEY_ENCRYPTION_KEY | TR31_K1_KEY_BLOCK_PROTECTION_KEY | TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT | TR31_M3_ISO_9797_3_MAC_KEY | TR31_M1_ISO_9797_1_MAC_KEY | TR31_M6_ISO_9797_5_CMAC_KEY | TR31_M7_HMAC_KEY | TR31_P0_PIN_ENCRYPTION_KEY | TR31_P1_PIN_GENERATION_KEY | TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE | TR31_V1_IBM3624_PIN_VERIFICATION_KEY | TR31_V2_VISA_PIN_VERIFICATION_KEY | TR31_K2_TR34_ASYMMETRIC_KEY /* required */
      },
      PublicKeyCertificate: 'STRING_VALUE' /* required */
    },
    Tr31KeyBlock: {
      WrappedKeyBlock: 'STRING_VALUE', /* required */
      WrappingKeyIdentifier: 'STRING_VALUE' /* required */
    },
    Tr34KeyBlock: {
      CertificateAuthorityPublicKeyIdentifier: 'STRING_VALUE', /* required */
      ImportToken: 'STRING_VALUE', /* required */
      KeyBlockFormat: X9_TR34_2012, /* required */
      SigningKeyCertificate: 'STRING_VALUE', /* required */
      WrappedKeyBlock: 'STRING_VALUE', /* required */
      RandomNonce: 'STRING_VALUE'
    },
    TrustedCertificatePublicKey: {
      CertificateAuthorityPublicKeyIdentifier: 'STRING_VALUE', /* required */
      KeyAttributes: { /* required */
        KeyAlgorithm: TDES_2KEY | TDES_3KEY | AES_128 | AES_192 | AES_256 | RSA_2048 | RSA_3072 | RSA_4096, /* required */
        KeyClass: SYMMETRIC_KEY | ASYMMETRIC_KEY_PAIR | PRIVATE_KEY | PUBLIC_KEY, /* required */
        KeyModesOfUse: { /* required */
          Decrypt: true || false,
          DeriveKey: true || false,
          Encrypt: true || false,
          Generate: true || false,
          NoRestrictions: true || false,
          Sign: true || false,
          Unwrap: true || false,
          Verify: true || false,
          Wrap: true || false
        },
        KeyUsage: TR31_B0_BASE_DERIVATION_KEY | TR31_C0_CARD_VERIFICATION_KEY | TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY | TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION | TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS | TR31_E1_EMV_MKEY_CONFIDENTIALITY | TR31_E2_EMV_MKEY_INTEGRITY | TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS | TR31_E5_EMV_MKEY_CARD_PERSONALIZATION | TR31_E6_EMV_MKEY_OTHER | TR31_K0_KEY_ENCRYPTION_KEY | TR31_K1_KEY_BLOCK_PROTECTION_KEY | TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT | TR31_M3_ISO_9797_3_MAC_KEY | TR31_M1_ISO_9797_1_MAC_KEY | TR31_M6_ISO_9797_5_CMAC_KEY | TR31_M7_HMAC_KEY | TR31_P0_PIN_ENCRYPTION_KEY | TR31_P1_PIN_GENERATION_KEY | TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE | TR31_V1_IBM3624_PIN_VERIFICATION_KEY | TR31_V2_VISA_PIN_VERIFICATION_KEY | TR31_K2_TR34_ASYMMETRIC_KEY /* required */
      },
      PublicKeyCertificate: 'STRING_VALUE' /* required */
    }
  },
  Enabled: true || false,
  KeyCheckValueAlgorithm: CMAC | ANSI_X9_24,
  Tags: [
    {
      Key: 'STRING_VALUE', /* required */
      Value: 'STRING_VALUE'
    },
    /* more items */
  ]
};
paymentcryptography.importKey(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyMaterial — (map)

    The key or public key certificate type to use during key material import, for example TR-34 or RootCertificatePublicKey.

    • RootCertificatePublicKey — (map)

      Parameter information for root public key certificate import.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the root public key is imported.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • PublicKeyCertificate — required — (String)

        Parameter information for root public key certificate import.

    • TrustedCertificatePublicKey — (map)

      Parameter information for trusted public key certificate import.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after a trusted public key is imported.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • PublicKeyCertificate — required — (String)

        Parameter information for trusted public key certificate import.

      • CertificateAuthorityPublicKeyIdentifier — required — (String)

        The KeyARN of the root public key certificate or certificate chain that signs the trusted public key certificate import.

    • Tr31KeyBlock — (map)

      Parameter information for key material import using symmetric TR-31 key exchange method.

      • WrappingKeyIdentifier — required — (String)

        The KeyARN of the key that will decrypt or unwrap a TR-31 key block during import.

      • WrappedKeyBlock — required — (String)

        The TR-31 wrapped key block to import.

    • Tr34KeyBlock — (map)

      Parameter information for key material import using the asymmetric TR-34 key exchange method.

      • CertificateAuthorityPublicKeyIdentifier — required — (String)

        The KeyARN of the certificate chain that signs the signing key certificate during TR-34 key import.

      • SigningKeyCertificate — required — (String)

        The public key component in PEM certificate format of the private key that signs the KDH TR-34 WrappedKeyBlock.

      • ImportToken — required — (String)

        The import token that initiates key import using the asymmetric TR-34 key exchange method into Amazon Web Services Payment Cryptography. It expires after 7 days. You can use the same import token to import multiple keys to the same service account.

      • WrappedKeyBlock — required — (String)

        The TR-34 wrapped key block to import.

      • KeyBlockFormat — required — (String)

        The key block format to use during key import. The only value allowed is X9_TR34_2012.

        Possible values include:
        • "X9_TR34_2012"
      • RandomNonce — (String)

        A random number value that is unique to the TR-34 key block generated using 2 pass. The operation will fail, if a random nonce value is not provided for a TR-34 key block generated using 2 pass.

    • KeyCryptogram — (map)

      Parameter information for key material import using asymmetric RSA wrap and unwrap key exchange method.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • Exportable — required — (Boolean)

        Specifies whether the key is exportable from the service.

      • WrappedKeyCryptogram — required — (String)

        The RSA wrapped key cryptogram under import.

      • ImportToken — required — (String)

        The import token that initiates key import using the asymmetric RSA wrap and unwrap key exchange method into AWS Payment Cryptography. It expires after 7 days. You can use the same import token to import multiple keys to the same service account.

      • WrappingSpec — (String)

        The wrapping spec for the wrapped key cryptogram.

        Possible values include:
        • "RSA_OAEP_SHA_256"
        • "RSA_OAEP_SHA_512"
  • KeyCheckValueAlgorithm — (String)

    The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

    For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

    Possible values include:
    • "CMAC"
    • "ANSI_X9_24"
  • Enabled — (Boolean)

    Specifies whether import key is enabled.

  • Tags — (Array<map>)

    Assigns one or more tags to the Amazon Web Services Payment Cryptography key. Use this parameter to tag a key when it is imported. To tag an existing Amazon Web Services Payment Cryptography key, use the TagResource operation.

    Each tag consists of a tag key and a tag value. Both the tag key and the tag value are required, but the tag value can be an empty (null) string. You can't have more than one tag on an Amazon Web Services Payment Cryptography key with the same tag key. If you specify an existing tag key with a different tag value, Amazon Web Services Payment Cryptography replaces the current tag value with the specified one.

    Don't include personal, confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.

    Note: Tagging or untagging an Amazon Web Services Payment Cryptography key can allow or deny permission to the key.
    • Key — required — (String)

      The key of the tag.

    • Value — (String)

      The value of the tag.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Key — (map)

      The KeyARN of the key material imported within Amazon Web Services Payment Cryptography.

      • KeyArn — required — (String)

        The Amazon Resource Name (ARN) of the key.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • KeyCheckValue — required — (String)

        The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.

      • KeyCheckValueAlgorithm — required — (String)

        The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

        For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

        Possible values include:
        • "CMAC"
        • "ANSI_X9_24"
      • Enabled — required — (Boolean)

        Specifies whether the key is enabled.

      • Exportable — required — (Boolean)

        Specifies whether the key is exportable. This data is immutable after the key is created.

      • KeyState — required — (String)

        The state of key that is being created or deleted.

        Possible values include:
        • "CREATE_IN_PROGRESS"
        • "CREATE_COMPLETE"
        • "DELETE_PENDING"
        • "DELETE_COMPLETE"
      • KeyOrigin — required — (String)

        The source of the key material. For keys created within Amazon Web Services Payment Cryptography, the value is AWS_PAYMENT_CRYPTOGRAPHY. For keys imported into Amazon Web Services Payment Cryptography, the value is EXTERNAL.

        Possible values include:
        • "EXTERNAL"
        • "AWS_PAYMENT_CRYPTOGRAPHY"
      • CreateTimestamp — required — (Date)

        The date and time when the key was created.

      • UsageStartTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will start using the key material for cryptographic operations.

      • UsageStopTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will stop using the key material for cryptographic operations.

      • DeletePendingTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when KeyState is DELETE_PENDING and the key is scheduled for deletion.

      • DeleteTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when when the KeyState is DELETE_COMPLETE and the Amazon Web Services Payment Cryptography key is deleted.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
paymentcryptography.listAliases(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • NextToken — (String)

    Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of NextToken from the truncated response you just received.

  • MaxResults — (Integer)

    Use this parameter to specify the maximum number of items to return. When this value is present, Amazon Web Services Payment Cryptography does not return more than the specified number of items, but it might return fewer.

    This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Aliases — (Array<map>)

      The list of aliases. Each alias describes the KeyArn contained within.

      • AliasName — required — (String)

        A friendly name that you can use to refer to a key. The value must begin with alias/.

        Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.

      • KeyArn — (String)

        The KeyARN of the key associated with the alias.

    • NextToken — (String)

      The token for the next set of results, or an empty or null value if there are no more results.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyState: CREATE_IN_PROGRESS | CREATE_COMPLETE | DELETE_PENDING | DELETE_COMPLETE,
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
paymentcryptography.listKeys(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyState — (String)

    The key state of the keys you want to list.

    Possible values include:
    • "CREATE_IN_PROGRESS"
    • "CREATE_COMPLETE"
    • "DELETE_PENDING"
    • "DELETE_COMPLETE"
  • NextToken — (String)

    Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of NextToken from the truncated response you just received.

  • MaxResults — (Integer)

    Use this parameter to specify the maximum number of items to return. When this value is present, Amazon Web Services Payment Cryptography does not return more than the specified number of items, but it might return fewer.

    This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Keys — (Array<map>)

      The list of keys created within the caller's Amazon Web Services account and Amazon Web Services Region.

      • KeyArn — required — (String)

        The Amazon Resource Name (ARN) of the key.

      • KeyState — required — (String)

        The state of an Amazon Web Services Payment Cryptography that is being created or deleted.

        Possible values include:
        • "CREATE_IN_PROGRESS"
        • "CREATE_COMPLETE"
        • "DELETE_PENDING"
        • "DELETE_COMPLETE"
      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • KeyCheckValue — required — (String)

        The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.

      • Exportable — required — (Boolean)

        Specifies whether the key is exportable. This data is immutable after the key is created.

      • Enabled — required — (Boolean)

        Specifies whether the key is enabled.

    • NextToken — (String)

      The token for the next set of results, or an empty or null value if there are no more results.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  ResourceArn: 'STRING_VALUE', /* required */
  MaxResults: 'NUMBER_VALUE',
  NextToken: 'STRING_VALUE'
};
paymentcryptography.listTagsForResource(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • ResourceArn — (String)

    The KeyARN of the key whose tags you are getting.

  • NextToken — (String)

    Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of NextToken from the truncated response you just received.

  • MaxResults — (Integer)

    Use this parameter to specify the maximum number of items to return. When this value is present, Amazon Web Services Payment Cryptography does not return more than the specified number of items, but it might return fewer.

    This value is optional. If you include a value, it must be between 1 and 100, inclusive. If you do not include a value, it defaults to 50.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Tags — (Array<map>)

      The list of tags associated with a ResourceArn. Each tag will list the key-value pair contained within that tag.

      • Key — required — (String)

        The key of the tag.

      • Value — (String)

        The value of the tag.

    • NextToken — (String)

      The token for the next set of results, or an empty or null value if there are no more results.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyIdentifier: 'STRING_VALUE' /* required */
};
paymentcryptography.restoreKey(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyIdentifier — (String)

    The KeyARN of the key to be restored within Amazon Web Services Payment Cryptography.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Key — (map)

      The key material of the restored key. The KeyState will change to CREATE_COMPLETE and value for DeletePendingTimestamp gets removed.

      • KeyArn — required — (String)

        The Amazon Resource Name (ARN) of the key.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • KeyCheckValue — required — (String)

        The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.

      • KeyCheckValueAlgorithm — required — (String)

        The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

        For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

        Possible values include:
        • "CMAC"
        • "ANSI_X9_24"
      • Enabled — required — (Boolean)

        Specifies whether the key is enabled.

      • Exportable — required — (Boolean)

        Specifies whether the key is exportable. This data is immutable after the key is created.

      • KeyState — required — (String)

        The state of key that is being created or deleted.

        Possible values include:
        • "CREATE_IN_PROGRESS"
        • "CREATE_COMPLETE"
        • "DELETE_PENDING"
        • "DELETE_COMPLETE"
      • KeyOrigin — required — (String)

        The source of the key material. For keys created within Amazon Web Services Payment Cryptography, the value is AWS_PAYMENT_CRYPTOGRAPHY. For keys imported into Amazon Web Services Payment Cryptography, the value is EXTERNAL.

        Possible values include:
        • "EXTERNAL"
        • "AWS_PAYMENT_CRYPTOGRAPHY"
      • CreateTimestamp — required — (Date)

        The date and time when the key was created.

      • UsageStartTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will start using the key material for cryptographic operations.

      • UsageStopTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will stop using the key material for cryptographic operations.

      • DeletePendingTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when KeyState is DELETE_PENDING and the key is scheduled for deletion.

      • DeleteTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when when the KeyState is DELETE_COMPLETE and the Amazon Web Services Payment Cryptography key is deleted.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyIdentifier: 'STRING_VALUE' /* required */
};
paymentcryptography.startKeyUsage(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyIdentifier — (String)

    The KeyArn of the key.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Key — (map)

      The KeyARN of the Amazon Web Services Payment Cryptography key activated for use.

      • KeyArn — required — (String)

        The Amazon Resource Name (ARN) of the key.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • KeyCheckValue — required — (String)

        The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.

      • KeyCheckValueAlgorithm — required — (String)

        The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

        For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

        Possible values include:
        • "CMAC"
        • "ANSI_X9_24"
      • Enabled — required — (Boolean)

        Specifies whether the key is enabled.

      • Exportable — required — (Boolean)

        Specifies whether the key is exportable. This data is immutable after the key is created.

      • KeyState — required — (String)

        The state of key that is being created or deleted.

        Possible values include:
        • "CREATE_IN_PROGRESS"
        • "CREATE_COMPLETE"
        • "DELETE_PENDING"
        • "DELETE_COMPLETE"
      • KeyOrigin — required — (String)

        The source of the key material. For keys created within Amazon Web Services Payment Cryptography, the value is AWS_PAYMENT_CRYPTOGRAPHY. For keys imported into Amazon Web Services Payment Cryptography, the value is EXTERNAL.

        Possible values include:
        • "EXTERNAL"
        • "AWS_PAYMENT_CRYPTOGRAPHY"
      • CreateTimestamp — required — (Date)

        The date and time when the key was created.

      • UsageStartTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will start using the key material for cryptographic operations.

      • UsageStopTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will stop using the key material for cryptographic operations.

      • DeletePendingTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when KeyState is DELETE_PENDING and the key is scheduled for deletion.

      • DeleteTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when when the KeyState is DELETE_COMPLETE and the Amazon Web Services Payment Cryptography key is deleted.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  KeyIdentifier: 'STRING_VALUE' /* required */
};
paymentcryptography.stopKeyUsage(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • KeyIdentifier — (String)

    The KeyArn of the key.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Key — (map)

      The KeyARN of the key.

      • KeyArn — required — (String)

        The Amazon Resource Name (ARN) of the key.

      • KeyAttributes — required — (map)

        The role of the key, the algorithm it supports, and the cryptographic operations allowed with the key. This data is immutable after the key is created.

        • KeyUsage — required — (String)

          The cryptographic usage of an Amazon Web Services Payment Cryptography key as defined in section A.5.2 of the TR-31 spec.

          Possible values include:
          • "TR31_B0_BASE_DERIVATION_KEY"
          • "TR31_C0_CARD_VERIFICATION_KEY"
          • "TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY"
          • "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION"
          • "TR31_E0_EMV_MKEY_APP_CRYPTOGRAMS"
          • "TR31_E1_EMV_MKEY_CONFIDENTIALITY"
          • "TR31_E2_EMV_MKEY_INTEGRITY"
          • "TR31_E4_EMV_MKEY_DYNAMIC_NUMBERS"
          • "TR31_E5_EMV_MKEY_CARD_PERSONALIZATION"
          • "TR31_E6_EMV_MKEY_OTHER"
          • "TR31_K0_KEY_ENCRYPTION_KEY"
          • "TR31_K1_KEY_BLOCK_PROTECTION_KEY"
          • "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT"
          • "TR31_M3_ISO_9797_3_MAC_KEY"
          • "TR31_M1_ISO_9797_1_MAC_KEY"
          • "TR31_M6_ISO_9797_5_CMAC_KEY"
          • "TR31_M7_HMAC_KEY"
          • "TR31_P0_PIN_ENCRYPTION_KEY"
          • "TR31_P1_PIN_GENERATION_KEY"
          • "TR31_S0_ASYMMETRIC_KEY_FOR_DIGITAL_SIGNATURE"
          • "TR31_V1_IBM3624_PIN_VERIFICATION_KEY"
          • "TR31_V2_VISA_PIN_VERIFICATION_KEY"
          • "TR31_K2_TR34_ASYMMETRIC_KEY"
        • KeyClass — required — (String)

          The type of Amazon Web Services Payment Cryptography key to create, which determines the classification of the cryptographic method and whether Amazon Web Services Payment Cryptography key contains a symmetric key or an asymmetric key pair.

          Possible values include:
          • "SYMMETRIC_KEY"
          • "ASYMMETRIC_KEY_PAIR"
          • "PRIVATE_KEY"
          • "PUBLIC_KEY"
        • KeyAlgorithm — required — (String)

          The key algorithm to be use during creation of an Amazon Web Services Payment Cryptography key.

          For symmetric keys, Amazon Web Services Payment Cryptography supports AES and TDES algorithms. For asymmetric keys, Amazon Web Services Payment Cryptography supports RSA and ECC_NIST algorithms.

          Possible values include:
          • "TDES_2KEY"
          • "TDES_3KEY"
          • "AES_128"
          • "AES_192"
          • "AES_256"
          • "RSA_2048"
          • "RSA_3072"
          • "RSA_4096"
        • KeyModesOfUse — required — (map)

          The list of cryptographic operations that you can perform using the key.

          • Encrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to encrypt data.

          • Decrypt — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to decrypt data.

          • Wrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to wrap other keys.

          • Unwrap — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to unwrap other keys.

          • Generate — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to generate and verify other card and PIN verification keys.

          • Sign — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used for signing.

          • Verify — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to verify signatures.

          • DeriveKey — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key can be used to derive new keys.

          • NoRestrictions — (Boolean)

            Specifies whether an Amazon Web Services Payment Cryptography key has no special restrictions other than the restrictions implied by KeyUsage.

      • KeyCheckValue — required — (String)

        The key check value (KCV) is used to check if all parties holding a given key have the same key or to detect that a key has changed.

      • KeyCheckValueAlgorithm — required — (String)

        The algorithm that Amazon Web Services Payment Cryptography uses to calculate the key check value (KCV). It is used to validate the key integrity.

        For TDES keys, the KCV is computed by encrypting 8 bytes, each with value of zero, with the key to be checked and retaining the 3 highest order bytes of the encrypted result. For AES keys, the KCV is computed using a CMAC algorithm where the input data is 16 bytes of zero and retaining the 3 highest order bytes of the encrypted result.

        Possible values include:
        • "CMAC"
        • "ANSI_X9_24"
      • Enabled — required — (Boolean)

        Specifies whether the key is enabled.

      • Exportable — required — (Boolean)

        Specifies whether the key is exportable. This data is immutable after the key is created.

      • KeyState — required — (String)

        The state of key that is being created or deleted.

        Possible values include:
        • "CREATE_IN_PROGRESS"
        • "CREATE_COMPLETE"
        • "DELETE_PENDING"
        • "DELETE_COMPLETE"
      • KeyOrigin — required — (String)

        The source of the key material. For keys created within Amazon Web Services Payment Cryptography, the value is AWS_PAYMENT_CRYPTOGRAPHY. For keys imported into Amazon Web Services Payment Cryptography, the value is EXTERNAL.

        Possible values include:
        • "EXTERNAL"
        • "AWS_PAYMENT_CRYPTOGRAPHY"
      • CreateTimestamp — required — (Date)

        The date and time when the key was created.

      • UsageStartTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will start using the key material for cryptographic operations.

      • UsageStopTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will stop using the key material for cryptographic operations.

      • DeletePendingTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when KeyState is DELETE_PENDING and the key is scheduled for deletion.

      • DeleteTimestamp — (Date)

        The date and time after which Amazon Web Services Payment Cryptography will delete the key. This value is present only when when the KeyState is DELETE_COMPLETE and the Amazon Web Services Payment Cryptography key is deleted.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  ResourceArn: 'STRING_VALUE', /* required */
  Tags: [ /* required */
    {
      Key: 'STRING_VALUE', /* required */
      Value: 'STRING_VALUE'
    },
    /* more items */
  ]
};
paymentcryptography.tagResource(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • ResourceArn — (String)

    The KeyARN of the key whose tags are being updated.

  • Tags — (Array<map>)

    One or more tags. Each tag consists of a tag key and a tag value. The tag value can be an empty (null) string. You can't have more than one tag on an Amazon Web Services Payment Cryptography key with the same tag key. If you specify an existing tag key with a different tag value, Amazon Web Services Payment Cryptography replaces the current tag value with the new one.

    Don't include personal, confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.

    To use this parameter, you must have TagResource permission in an IAM policy.

    Don't include personal, confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.

    • Key — required — (String)

      The key of the tag.

    • Value — (String)

      The value of the tag.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  ResourceArn: 'STRING_VALUE', /* required */
  TagKeys: [ /* required */
    'STRING_VALUE',
    /* more items */
  ]
};
paymentcryptography.untagResource(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • ResourceArn — (String)

    The KeyARN of the key whose tags are being removed.

  • TagKeys — (Array<String>)

    One or more tag keys. Don't include the tag values.

    If the Amazon Web Services Payment Cryptography key doesn't have the specified tag key, Amazon Web Services Payment Cryptography doesn't throw an exception or return a response. To confirm that the operation succeeded, use the ListTagsForResource operation.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  AliasName: 'STRING_VALUE', /* required */
  KeyArn: 'STRING_VALUE'
};
paymentcryptography.updateAlias(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • AliasName — (String)

    The alias whose associated key is changing.

  • KeyArn — (String)

    The KeyARN for the key that you are updating or removing from the alias.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • Alias — (map)

      The alias name.

      • AliasName — required — (String)

        A friendly name that you can use to refer to a key. The value must begin with alias/.

        Do not include confidential or sensitive information in this field. This field may be displayed in plaintext in CloudTrail logs and other output.

      • KeyArn — (String)

        The KeyARN of the key associated with the alias.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

Parameters:

• state (String) —

  the resource state to wait for. Available states for this service are listed in "Waiter Resource States" below.

• params (map) (defaults to: {}) —

  a list of parameters for the given state. See each waiter resource state for required parameters.

Callback (callback):

• function(err, data) { ... }

  Callback containing error and data information. See the respective resource state for the expected error or data information.

  If the waiter times out its requests, it will return a ResourceNotReady error.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.