# Reported issues for AWS Payment Cryptography

Pod holds 16 of 30 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [AWS Payment Cryptography](/mcp/aws-payment-cryptography).

## Most discussed

### [kb] Thales/Atalla compatibility bridge for Futurex Standard/International command field syntax

## Contribution Type
kb_entry

## Source
CyberChef-Payments (Futurex General Payment HSM IG PDF cross-referenced with public Thales payShield manuals)

## Content to Add

BRIDGE: obtain field-level syntax for Futurex's STANDARD and INTERNATIONAL command families without Futurex docs access.

Futurex "Standard" (numeric) and "International" command families are Thales payShield / Atalla-COMPATIBLE. Proven from the public General Payment HSM IG PDF: Standard numeric codes match Thales/Atalla verba

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/38) · 2026-07-11 · closed · 1 comment

### [kb] Authoritative Futurex names for 61 device-confirmed Excrypt commands (+ RSAR correction)

## Contribution Type
kb_entry

## Source
docs.futurex.com Host API command tables (via /llms-full.txt), filtered to the device-confirmed Excrypt code set

## Content to Add

Authoritative Futurex NAMES for the 61 Excrypt command codes that are BOTH documented at docs.futurex.com AND present in the real device config enabled-command list (companion 272-code finding). These are high-confidence: authoritative name + confirmed-real code. Use to name/validate the MCP Futurex registry.

  ADPK = PKI D

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/35) · 2026-07-11 · closed · 1 comment

### [kb] CORRECTION: docs.futurex.com IS mineable via /llms-full.txt (Mintlify) — supersedes not-crawlable note

## Contribution Type
apc_constraint

## Source
CyberChef-Payments Futurex parser — docs mining

## Content to Add

Updates the earlier sourcing-landscape finding that called docs.futurex.com "a JS-rendered SPA, not crawlable." It IS crawlable — docs.futurex.com is a Mintlify site, so:

  https://docs.futurex.com/llms-full.txt   -> ~7.5 MB of the ENTIRE docs as markdown, each page preceded by "Source: <url>". Contains the Host API command-reference tables as HTML <table> blocks: <td><strong>CODE<

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/34) · 2026-07-11 · closed · 1 comment

### [kb] Futurex asymmetric key-exchange command tag maps + enum token tables

## Contribution Type
kb_entry

## Source
CyberChef-Payments Futurex parser (aws-samples public key-exchange sample .../key_exchange/hsm/futurex/commands.py)

## Content to Add

Command-scoped Excrypt tag maps for the asymmetric key-exchange set, from a public code sample whose function signatures name each parameter and whose enum tables decode the values. SINGLE SOURCE, MEDIUM confidence, not verified against the Futurex TRM. Only tags bound to a named param / response token / enum are listed; 

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/33) · 2026-07-11 · closed · 1 comment

### [kb] Authoritative Futurex Excrypt command-code set (272 codes) from a device config report

## Contribution Type
kb_entry

## Source
Futurex HSM device ConfigurationReport (Excrypt Touch, FW 7.4.1) — role Permissions listing

## Content to Add

Ground-truth set of Excrypt command CODES on a real Futurex HSM, from the role "Permissions" list in a device Configuration Report (each entry "Excrypt:<CODE>"). Authoritative for CODE EXISTENCE only (not names, not tag syntax).

272 codes (general-purpose profile; PAYMENT/EMV commands like EMVA/EMVG/EMVM/GCAV/GDCV/VEMI are absent because the pa

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/32) · 2026-07-11 · closed · 1 comment

### [kb] Futurex Excrypt public-sourcing landscape: only 3 open-code sources; authoritative dict is gated

## Contribution Type
apc_constraint

## Source
CyberChef-Payments Futurex parser — exhaustive sourcing sweep

## Content to Add

Sourcing map for Futurex Excrypt command syntax (so future sessions don't re-search from scratch):

OPEN CODE SOURCES — the complete set is only THREE GitHub repos (nothing on npm/PyPI/Maven/crates, no Stack Overflow / Crypto SE / GitLab / Bitbucket / SourceForge):
  1. github.com/kakubila/jpos-excrypt-interface — EMVA, GCVV, TPIN tags; PROTECTED_TAGS; ERRO/GF.
  2. gi

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/31) · 2026-07-11 · closed · 1 comment

### [kb] EMVA tag map corroborated by a second public integration (KM=1, NP tag, BB-on-EMVA)

## Contribution Type
kb_entry

## Target File
payment-knowledge-base.md

## Source
CyberChef-Payments Futurex parser (github.com/RicardoVercetti/RandomCodeScraps Python/Scripts/emva_command.py)

## Content to Add

Corroboration for the EMVA tag map filed in issue #29 (was single-source jPOS). A second
independent public integration — a live Futurex EMVA request script — sends:

  [AOEMVA;FS0;KM1;KP<16-byte IMK-AC, clear in test>;KQ<PAN>;KR01;KS002E;KT<CDOL>;BO<ARQC 8B>;NP0;]
  response: [AOEMVA;

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/30) · 2026-07-11 · closed · 1 comment

### [kb] Futurex Excrypt command-scoped tag maps, PROTECTED_TAGS sensitive list, and ERRO/GF conventions from jPOS integration

## Contribution Type
kb_entry

## Target File
payment-knowledge-base.md

## Source
CyberChef-Payments Futurex parser (github.com/kakubila/jpos-excrypt-interface)

## Content to Add

source: github.com/kakubila/jpos-excrypt-interface (jPOS channel + Message.java), MEDIUM confidence
  — a single real integration; tags NOT verified against the Futurex TRM. Corroborates the
    VirtuCrypt-sourced TPIN/CPIN/EPIN tags (now two independent integrations).

futurex_excrypt_command_scoped_tags:
  note: Ex

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/29) · 2026-07-10 · closed · 1 comment

## Most recent

### [kb] Add Futurex Excrypt GCVV (Generate CVV/CVC) command to registry

## Contribution Type
hsm_command

## Target File
hsm_analysis.py  — ALL_COMMANDS list

## Source
CyberChef-Payments Futurex parser enrichment (github.com/kakubila/jpos-excrypt-interface)

## Content to Add

HsmCommand(
    vendor="Futurex",
    api="Excrypt",
    command_code="GCVV",
    name="Generate CVV or CVC Value",
    category="CVV",
    description="Generates a card verification value (CVV/CVC/iCVV) from PAN, expiry, and service code under a card-verification key pair (CVK-A/CVK-B).",
  

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/28) · 2026-07-10 · closed · 0 comments

### [kb] Futurex Excrypt CPIN/EPIN commands + AF tag + GF status (from live VirtuCrypt integration; registry gap)

## Contribution Type
hsm_command — hsm_analysis.py ALL_COMMANDS

## Source
CyberChef-Payments Futurex parser enrichment; primary source: github.com/HoracioME/testms api-base-main/app/common/services/hsm_service.py @ 04fcff7 (a live VirtuCrypt integration). VirtuCrypt is Futurex's hosted cloud HSM and uses the same Excrypt command language, so these are genuine Excrypt commands, not vendor-specific.

## Confidence
MEDIUM. Single public source (real integration code, not the Futurex TRM/firmware).

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/27) · 2026-07-10 · closed · 1 comment

### [kb] Futurex Excrypt key-exchange wire format: framing + tag map (medium confidence, from AWS public sample)

## Contribution Type
kb_entry

## Target File
payment-knowledge-base.md

## Source
apc-hsm-proxy (futurex.rs) + aws-samples/samples-for-payment-cryptography-service (commands.py)

## Content to Add

topic: Futurex Excrypt key-exchange wire format (tags + wrap commands)
confidence: medium
source: AWS public sample — aws-samples/samples-for-payment-cryptography-service, key_exchange/hsm/futurex/commands.py; framing corroborated by apc-hsm-proxy src/protocol/futurex.rs
verification: SINGLE SOURCE (

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/21) · 2026-07-05 · closed · 0 comments

### [kb] APC key import/export constraints: HMAC needs AES-256 KEK; RSA-wrap only TDES/AES-128; CA >= child cert

## Contribution Type
apc_constraint

## Target File
AGENTS.md — Key Constraints section

## Source
aws-samples/samples-for-payment-cryptography-service `migration_guidance/payshield-command-mapping.md` + `key_exchange/utils/apc.py` (verified verbatim)

## Content to Add
- **HMAC keys** — "HMAC require use of TR-31 optional header HM and can only be imported protected by AES-256 KEK." On export the service auto-adds HM; the KEK must be AES-256.
- **RSA-wrapped (KEY_CRYPTOGRAM / OAEP)** — supports

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/20) · 2026-07-05 · closed · 0 comments

### [kb] APC VerifyAuthRequestCryptogram: Visa (Scheme 0/CVN17) and Amex (Scheme 2) do not use ATC or UN

## Contribution Type
apc_constraint

## Target File
AGENTS.md — Key Constraints section

## Source
aws-samples/samples-for-payment-cryptography-service `migration_guidance/payshield-command-mapping.md` (verified against source)

## Content to Add
For `VerifyAuthRequestCryptogram`:
- **Visa (Scheme 0, VIS / CVN17)** — MajorKeyDerivationMode=A, SessionKeyDerivation=Visa. "This algorithm does not use ATC or UN despite being mandatory fields in the payShield interface, hence they are not available i

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/19) · 2026-07-05 · closed · 0 comments

### [kb] BU (Generate a Key Check Value) upgraded: verified against PUGD0537-004 Rev A Core Host Commands — key-block form, KCV methods, authorization rule

## Contribution Type
hsm_command

## Target File
hsm_analysis.py  — ALL_COMMANDS list

## Source
apc-hsm-proxy hsm_probe (PR #46 / issue #15)

## Content to Add

Update the existing BU entry (currently "EFTlab source — reference quality", confidence medium):

- vendor/api: it is a payShield 10K **Core** host command — PUGD0537-004 Rev A, "Generate a check value for a key encrypted under an LMK pair" (BU, response BV) — not only an International/EFTlab reference.
- confidence: high (verified agai

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/18) · 2026-07-03 · closed · 0 comments

### [kb] JU and KU (issuer-script MAC, mode 0) are now functional handlers in apc-hsm-proxy — add to _PROXY_HANDLERS thales_payshield

## Contribution Type
proxy_handler

## Target File
hsm_tools.py     — _PROXY_HANDLERS dict

## Source
apc-hsm-proxy issuer_script_mac.rs (PR #45, closes #24)

## Content to Add

        "JU", "KU",                        # Issuer-script MAC (mode 0 integrity, via GenerateMac/EmvMac)

## Context
Mode 0 (integrity) only: JU scheme '1' (UnionPay CUP 4.2) and KU schemes '0'/'1'/'2'/'5' (Visa VIS, Mastercard M/Chip, Amex AEIPS, JCB CVN04). Still gated: KY (IV-SMI/key-tree not modelled by APC EmvMac),

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/17) · 2026-07-03 · closed · 0 comments

### [kb] APC GenerateMac/EmvMac performs EMV issuer-script session-key derivation (IMK-SMI→SK-SMI); SessionKeyDerivationValue member is dictated by SessionKeyDerivationMode

## Contribution Type
kb_entry

## Target File
payment-knowledge-base.md

## Source
apc-hsm-proxy issuer_script_mac handler (JU/KU mode 0, PR #45 / issue #24)

## Content to Add

### APC: GenerateMac EmvMac Derives Issuer-Script Session Keys (IMK-SMI → SK-SMI)

```yaml
id: rule.apc-emvmac-issuer-script-session-key
entity_type: constraint_rule
canonical_name: APC GenerateMac EmvMac Performs Full Issuer-Script Session-Key Derivation
summary: >
  For EMV issuer-script (secure-messaging integrity) MA

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/16) · 2026-07-03 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/J8k3/aws-payment-cryptography-mcp/issues).