There are more AWS SDK examples available in the [AWS Doc SDK Examples](https://github.com/awsdocs/aws-doc-sdk-examples) GitHub repo.
# AWS Payment Cryptography Data Plane examples using AWS CLI
The following code examples show you how to perform actions and implement common scenarios by using the AWS Command Line Interface with AWS Payment Cryptography Data Plane.
*Actions* are code excerpts from larger programs and must be run in context. While actions show you how to call individual service functions, you can see actions in context in their related scenarios.
Each example includes a link to the complete source code, where you can find instructions on how to set up and run the code in context.
**Topics**
+ [Actions](#actions)
## Actions
### `decrypt-data`
The following code example shows how to use `decrypt-data`.
**AWS CLI**
**To decrypt ciphertext**
The following `decrypt-data` example decrypts ciphertext data using a symmetric key. For this operation, the key must have `KeyModesOfUse` set to `Decrypt` and `KeyUsage` set to `TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY`.
```
aws payment-cryptography-data decrypt-data \
--key-identifier arn:aws:payment-cryptography:us-east-2:123456789012:key/kwapwa6qaifllw2h \
--cipher-text 33612AB9D6929C3A828EB6030082B2BD \
--decryption-attributes 'Symmetric={Mode=CBC}'
```
Output:
```
{
"KeyArn": "arn:aws:payment-cryptography:us-east-2:123456789012:key/kwapwa6qaifllw2h",
"KeyCheckValue": "71D7AE",
"PlainText": "31323334313233343132333431323334"
}
```
For more information, see [Decrypt data](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/decrypt-data.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [DecryptData](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/decrypt-data.html) in *AWS CLI Command Reference*.
### `encrypt-data`
The following code example shows how to use `encrypt-data`.
**AWS CLI**
**To encrypt data**
The following `encrypt-data` example encrypts plaintext data using a symmetric key. For this operation, the key must have `KeyModesOfUse` set to `Encrypt` and `KeyUsage` set to `TR31_D0_SYMMETRIC_DATA_ENCRYPTION_KEY`.
```
aws payment-cryptography-data encrypt-data \
--key-identifier arn:aws:payment-cryptography:us-east-2:123456789012:key/kwapwa6qaifllw2h \
--plain-text 31323334313233343132333431323334 \
--encryption-attributes 'Symmetric={Mode=CBC}'
```
Output:
```
{
"KeyArn": "arn:aws:payment-cryptography:us-east-2:123456789012:key/kwapwa6qaifllw2h",
"KeyCheckValue": "71D7AE",
"CipherText": "33612AB9D6929C3A828EB6030082B2BD"
}
```
For more information, see [Encrypt data](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/encrypt-data.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [EncryptData](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/encrypt-data.html) in *AWS CLI Command Reference*.
### `generate-card-validation-data`
The following code example shows how to use `generate-card-validation-data`.
**AWS CLI**
**To generate a CVV**
The following `generate-card-validation-data` example generates a CVV/CVV2.
```
aws payment-cryptography-data generate-card-validation-data \
--key-identifier arn:aws:payment-cryptography:us-east-2:123456789012:key/kwapwa6qaifllw2h \
--primary-account-number=171234567890123 \
--generation-attributes CardVerificationValue2={CardExpiryDate=0123}
```
Output:
```
{
"KeyArn": "arn:aws:payment-cryptography:us-east-2:123456789012:key/kwapwa6qaifllw2h",
"KeyCheckValue": "CADDA1",
"ValidationData": "801"
}
```
For more information, see [Generate card data](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/generate-card-data.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [GenerateCardValidationData](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/generate-card-validation-data.html) in *AWS CLI Command Reference*.
### `generate-mac`
The following code example shows how to use `generate-mac`.
**AWS CLI**
**To generate a MAC**
The following `generate-card-validation-data` example generates a Hash-Based Message Authentication Code (HMAC) for card data authentication using the algorithm HMAC\$1SHA256 and an HMAC encryption key. The key must have `KeyUsage` set to `TR31_M7_HMAC_KEY` and `KeyModesOfUse` to `Generate`.
```
aws payment-cryptography-data generate-mac \
--key-identifier arn:aws:payment-cryptography:us-east-2:123456789012:key/kwapwa6qaifllw2h \
--message-data "3b313038383439303031303733393431353d32343038323236303030373030303f33" \
--generation-attributes Algorithm=HMAC_SHA256
```
Output:
```
{
"KeyArn": "arn:aws:payment-cryptography:us-east-2:123456789012:key/kwapwa6qaifllw2h,
"KeyCheckValue": "2976E7",
"Mac": "ED87F26E961C6D0DDB78DA5038AA2BDDEA0DCE03E5B5E96BDDD494F4A7AA470C"
}
```
For more information, see [Generate MAC](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/generate-mac.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [GenerateMac](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/generate-mac.html) in *AWS CLI Command Reference*.
### `generate-pin-data`
The following code example shows how to use `generate-pin-data`.
**AWS CLI**
**To generate a PIN**
The following `generate-card-validation-data` example generate a new random PIN using the Visa PIN scheme.
```
aws payment-cryptography-data generate-pin-data \
--generation-key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/37y2tsl45p5zjbh2 \
--encryption-key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/ivi5ksfsuplneuyt \
--primary-account-number 171234567890123 \
--pin-block-format ISO_FORMAT_0 \
--generation-attributes VisaPin={PinVerificationKeyIndex=1}
```
Output:
```
{
"GenerationKeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/37y2tsl45p5zjbh2",
"GenerationKeyCheckValue": "7F2363",
"EncryptionKeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/ivi5ksfsuplneuyt",
"EncryptionKeyCheckValue": "7CC9E2",
"EncryptedPinBlock": "AC17DC148BDA645E",
"PinData": {
"VerificationValue": "5507"
}
}
```
For more information, see [Generate PIN data](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/generate-pin-data.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [GeneratePinData](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/generate-pin-data.html) in *AWS CLI Command Reference*.
### `re-encrypt-data`
The following code example shows how to use `re-encrypt-data`.
**AWS CLI**
**To re-encrypt data with a different key**
The following `re-encrypt-data` example decrypts cipher text that was encrypted using an AES symmetric key and re-encrypts it using a Derived Unique Key Per Transaction (DUKPT) key.
```
aws payment-cryptography-data re-encrypt-data \
--incoming-key-identifier arn:aws:payment-cryptography:us-west-2:111122223333:key/hyvv7ymboitd4vfy \
--outgoing-key-identifier arn:aws:payment-cryptography:us-west-2:111122223333:key/jl6ythkcvzesbxen \
--cipher-text 4D2B0BDBA192D5AEFEAA5B3EC28E4A65383C313FFA25140101560F75FE1B99F27192A90980AB9334 \
--incoming-encryption-attributes "Dukpt={Mode=ECB,KeySerialNumber=0123456789111111}" \
--outgoing-encryption-attributes '{"Symmetric": {"Mode": "ECB"}}'
```
Output:
```
{
"CipherText": "F94959DA30EEFF0C035483C6067667CF6796E3C1AD28C2B61F9CFEB772A8DD41C0D6822931E0D3B1",
"KeyArn": "arn:aws:payment-cryptography:us-west-2:111122223333:key/jl6ythkcvzesbxen",
"KeyCheckValue": "2E8CD9"
}
```
For more information, see [Encrypt and decrypt data](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops.encryptdecrypt.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [ReEncryptData](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/re-encrypt-data.html) in *AWS CLI Command Reference*.
### `translate-pin-data`
The following code example shows how to use `translate-pin-data`.
**AWS CLI**
**To translate PIN data**
The following `translate-pin-data` example translates a PIN from PEK TDES encryption using ISO 0 PIN block to an AES ISO 4 PIN Block using the DUKPT algorithm.
```
aws payment-cryptography-data translate-pin-data \
--encrypted-pin-block "AC17DC148BDA645E" \
--incoming-translation-attributes=IsoFormat0='{PrimaryAccountNumber=171234567890123}' \
--incoming-key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/ivi5ksfsuplneuyt \
--outgoing-key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/4pmyquwjs3yj4vwe \
--outgoing-translation-attributes IsoFormat4="{PrimaryAccountNumber=171234567890123}" \
--outgoing-dukpt-attributes KeySerialNumber="FFFF9876543210E00008"
```
Output:
```
{
"PinBlock": "1F4209C670E49F83E75CC72E81B787D9",
"KeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/ivi5ksfsuplneuyt
"KeyCheckValue": "7CC9E2"
}
```
For more information, see [Translate PIN data](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/translate-pin-data.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [TranslatePinData](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/translate-pin-data.html) in *AWS CLI Command Reference*.
### `verify-auth-request-cryptogram`
The following code example shows how to use `verify-auth-request-cryptogram`.
**AWS CLI**
**To verify an auth request**
The following `verify-auth-request-cryptogram` example verifies an Authorization Request Cryptogram (ARQC).
```
aws payment-cryptography-data verify-auth-request-cryptogram \
--auth-request-cryptogram F6E1BD1E6037FB3E \
--auth-response-attributes '{"ArpcMethod1": {"AuthResponseCode": "1111"}}' \
--key-identifier arn:aws:payment-cryptography:us-west-2:111122223333:key/pboipdfzd4mdklya \
--major-key-derivation-mode "EMV_OPTION_A" \
--session-key-derivation-attributes '{"EmvCommon": {"ApplicationTransactionCounter": "1234","PanSequenceNumber": "01","PrimaryAccountNumber": "471234567890123"}}' \
--transaction-data "123456789ABCDEF"
```
Output:
```
{
"AuthResponseValue": "D899B8C6FBF971AA",
"KeyArn": "arn:aws:payment-cryptography:us-west-2:111122223333:key/pboipdfzd4mdklya",
"KeyCheckValue": "985792"
}
```
For more information, see [Verify auth request (ARQC) cryptogram](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/data-operations.verifyauthrequestcryptogram.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [VerifyAuthRequestCryptogram](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/verify-auth-request-cryptogram.html) in *AWS CLI Command Reference*.
### `verify-card-validation-data`
The following code example shows how to use `verify-card-validation-data`.
**AWS CLI**
**To validate a CVV**
The following `verify-card-validation-data` example validates a CVV/CVV2 for a PAN.
```
aws payment-cryptography-data verify-card-validation-data \
--key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/tqv5yij6wtxx64pi \
--primary-account-number=171234567890123 \
--verification-attributes CardVerificationValue2={CardExpiryDate=0123} \
--validation-data 801
```
Output:
```
{
"KeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/tqv5yij6wtxx64pi",
"KeyCheckValue": "CADDA1"
}
```
For more information, see [Verify card data](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/verify-card-data.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [VerifyCardValidationData](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/verify-card-validation-data.html) in *AWS CLI Command Reference*.
### `verify-mac`
The following code example shows how to use `verify-mac`.
**AWS CLI**
**To verify a MAC**
The following `verify-mac` example verifies a Hash-Based Message Authentication Code (HMAC) for card data authentication using the algorithm HMAC\$1SHA256 and an HMAC encryption key.
```
aws payment-cryptography-data verify-mac \
--key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/qnobl5lghrzunce6 \
--message-data "3b343038383439303031303733393431353d32343038323236303030373030303f33" \
--verification-attributes='Algorithm=HMAC_SHA256' \
--mac ED87F26E961C6D0DDB78DA5038AA2BDDEA0DCE03E5B5E96BDDD494F4A7AA470C
```
Output:
```
{
"KeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/qnobl5lghrzunce6,
"KeyCheckValue": "2976E7",
}
```
For more information, see [Verify MAC](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/verify-mac.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [VerifyMac](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/verify-mac.html) in *AWS CLI Command Reference*.
### `verify-pin-data`
The following code example shows how to use `verify-pin-data`.
**AWS CLI**
**To verify a PIN**
The following `verify-pin-data` example validates a PIN for a PAN.
```
aws payment-cryptography-data verify-pin-data \
--verification-key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/37y2tsl45p5zjbh2 \
--encryption-key-identifier arn:aws:payment-cryptography:us-east-2:111122223333:key/ivi5ksfsuplneuyt \
--primary-account-number 171234567890123 \
--pin-block-format ISO_FORMAT_0 \
--verification-attributes VisaPin="{PinVerificationKeyIndex=1,VerificationValue=5507}" \
--encrypted-pin-block AC17DC148BDA645E
```
Output:
```
{
"VerificationKeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/37y2tsl45p5zjbh2",
"VerificationKeyCheckValue": "7F2363",
"EncryptionKeyArn": "arn:aws:payment-cryptography:us-east-2:111122223333:key/ivi5ksfsuplneuyt",
"EncryptionKeyCheckValue": "7CC9E2",
}
```
For more information, see [Verify PIN data](https://docs.aws.amazon.com/payment-cryptography/latest/userguide/verify-pin-data.html) in the *AWS Payment Cryptography User Guide*.
+ For API details, see [VerifyPinData](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/payment-cryptography-data/verify-pin-data.html) in *AWS CLI Command Reference*.