pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for AWS Payment Cryptography

Pod holds 16 of 30 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to AWS Payment Cryptography.

Most discussed

[kb] Thales/Atalla compatibility bridge for Futurex Standard/International command field syntax

Contribution Type

kb_entry

Source

CyberChef-Payments (Futurex General Payment HSM IG PDF cross-referenced with public Thales payShield manuals)

Content to Add

BRIDGE: obtain field-level syntax for Futurex's STANDARD and INTERNATIONAL command families without Futurex docs access.

Futurex "Standard" (numeric) and "International" command families are Thales payShield / Atalla-COMPATIBLE. Proven from the public General Payment HSM IG PDF: Standard numeric codes match Thales/Atalla verba

Read the thread · 2026-07-11 · closed · 1 comment

[kb] Authoritative Futurex names for 61 device-confirmed Excrypt commands (+ RSAR correction)

Contribution Type

kb_entry

Source

docs.futurex.com Host API command tables (via /llms-full.txt), filtered to the device-confirmed Excrypt code set

Content to Add

Authoritative Futurex NAMES for the 61 Excrypt command codes that are BOTH documented at docs.futurex.com AND present in the real device config enabled-command list (companion 272-code finding). These are high-confidence: authoritative name + confirmed-real code. Use to name/validate the MCP Futurex registry.

ADPK = PKI D

Read the thread · 2026-07-11 · closed · 1 comment

[kb] CORRECTION: docs.futurex.com IS mineable via /llms-full.txt (Mintlify) — supersedes not-crawlable note

Contribution Type

apc_constraint

Source

CyberChef-Payments Futurex parser — docs mining

Content to Add

Updates the earlier sourcing-landscape finding that called docs.futurex.com "a JS-rendered SPA, not crawlable." It IS crawlable — docs.futurex.com is a Mintlify site, so:

https://docs.futurex.com/llms-full.txt -> ~7.5 MB of the ENTIRE docs as markdown, each page preceded by "Source: ". Contains the Host API command-reference tables as HTML

blocks:
CODE<

Read the thread · 2026-07-11 · closed · 1 comment

[kb] Futurex asymmetric key-exchange command tag maps + enum token tables

Contribution Type

kb_entry

Source

CyberChef-Payments Futurex parser (aws-samples public key-exchange sample .../key_exchange/hsm/futurex/commands.py)

Content to Add

Command-scoped Excrypt tag maps for the asymmetric key-exchange set, from a public code sample whose function signatures name each parameter and whose enum tables decode the values. SINGLE SOURCE, MEDIUM confidence, not verified against the Futurex TRM. Only tags bound to a named param / response token / enum are listed;

Read the thread · 2026-07-11 · closed · 1 comment

[kb] Authoritative Futurex Excrypt command-code set (272 codes) from a device config report

Contribution Type

kb_entry

Source

Futurex HSM device ConfigurationReport (Excrypt Touch, FW 7.4.1) — role Permissions listing

Content to Add

Ground-truth set of Excrypt command CODES on a real Futurex HSM, from the role "Permissions" list in a device Configuration Report (each entry "Excrypt:"). Authoritative for CODE EXISTENCE only (not names, not tag syntax).

272 codes (general-purpose profile; PAYMENT/EMV commands like EMVA/EMVG/EMVM/GCAV/GDCV/VEMI are absent because the pa

Read the thread · 2026-07-11 · closed · 1 comment

[kb] Futurex Excrypt public-sourcing landscape: only 3 open-code sources; authoritative dict is gated

Contribution Type

apc_constraint

Source

CyberChef-Payments Futurex parser — exhaustive sourcing sweep

Content to Add

Sourcing map for Futurex Excrypt command syntax (so future sessions don't re-search from scratch):

OPEN CODE SOURCES — the complete set is only THREE GitHub repos (nothing on npm/PyPI/Maven/crates, no Stack Overflow / Crypto SE / GitLab / Bitbucket / SourceForge):

  1. github.com/kakubila/jpos-excrypt-interface — EMVA, GCVV, TPIN tags; PROTECTED_TAGS; ERRO/GF.
  2. gi

Read the thread · 2026-07-11 · closed · 1 comment

[kb] EMVA tag map corroborated by a second public integration (KM=1, NP tag, BB-on-EMVA)

Contribution Type

kb_entry

Target File

payment-knowledge-base.md

Source

CyberChef-Payments Futurex parser (github.com/RicardoVercetti/RandomCodeScraps Python/Scripts/emva_command.py)

Content to Add

Corroboration for the EMVA tag map filed in issue #29 (was single-source jPOS). A second independent public integration — a live Futurex EMVA request script — sends:

[AOEMVA;FS0;KM1;KP<16-byte IMK-AC, clear in test>;KQ;KR01;KS002E;KT;BO;NP0;] response: [AOEMVA;

Read the thread · 2026-07-11 · closed · 1 comment

[kb] Futurex Excrypt command-scoped tag maps, PROTECTED_TAGS sensitive list, and ERRO/GF conventions from jPOS integration

Contribution Type

kb_entry

Target File

payment-knowledge-base.md

Source

CyberChef-Payments Futurex parser (github.com/kakubila/jpos-excrypt-interface)

Content to Add

source: github.com/kakubila/jpos-excrypt-interface (jPOS channel + Message.java), MEDIUM confidence — a single real integration; tags NOT verified against the Futurex TRM. Corroborates the VirtuCrypt-sourced TPIN/CPIN/EPIN tags (now two independent integrations).

futurex_excrypt_command_scoped_tags: note: Ex

Read the thread · 2026-07-10 · closed · 1 comment

Most recent

[kb] Add Futurex Excrypt GCVV (Generate CVV/CVC) command to registry

Contribution Type

hsm_command

Target File

hsm_analysis.py — ALL_COMMANDS list

Source

CyberChef-Payments Futurex parser enrichment (github.com/kakubila/jpos-excrypt-interface)

Content to Add

HsmCommand( vendor="Futurex", api="Excrypt", command_code="GCVV", name="Generate CVV or CVC Value", category="CVV", description="Generates a card verification value (CVV/CVC/iCVV) from PAN, expiry, and service code under a card-verification key pair (CVK-A/CVK-B).",

Read the thread · 2026-07-10 · closed · 0 comments

[kb] Futurex Excrypt CPIN/EPIN commands + AF tag + GF status (from live VirtuCrypt integration; registry gap)

Contribution Type

hsm_command — hsm_analysis.py ALL_COMMANDS

Source

CyberChef-Payments Futurex parser enrichment; primary source: github.com/HoracioME/testms api-base-main/app/common/services/hsm_service.py @ 04fcff7 (a live VirtuCrypt integration). VirtuCrypt is Futurex's hosted cloud HSM and uses the same Excrypt command language, so these are genuine Excrypt commands, not vendor-specific.

Confidence

MEDIUM. Single public source (real integration code, not the Futurex TRM/firmware).

Read the thread · 2026-07-10 · closed · 1 comment

[kb] Futurex Excrypt key-exchange wire format: framing + tag map (medium confidence, from AWS public sample)

Contribution Type

kb_entry

Target File

payment-knowledge-base.md

Source

apc-hsm-proxy (futurex.rs) + aws-samples/samples-for-payment-cryptography-service (commands.py)

Content to Add

topic: Futurex Excrypt key-exchange wire format (tags + wrap commands) confidence: medium source: AWS public sample — aws-samples/samples-for-payment-cryptography-service, key_exchange/hsm/futurex/commands.py; framing corroborated by apc-hsm-proxy src/protocol/futurex.rs verification: SINGLE SOURCE (

Read the thread · 2026-07-05 · closed · 0 comments

[kb] APC key import/export constraints: HMAC needs AES-256 KEK; RSA-wrap only TDES/AES-128; CA >= child cert

Contribution Type

apc_constraint

Target File

AGENTS.md — Key Constraints section

Source

aws-samples/samples-for-payment-cryptography-service migration_guidance/payshield-command-mapping.md + key_exchange/utils/apc.py (verified verbatim)

Content to Add

  • HMAC keys — "HMAC require use of TR-31 optional header HM and can only be imported protected by AES-256 KEK." On export the service auto-adds HM; the KEK must be AES-256.
  • RSA-wrapped (KEY_CRYPTOGRAM / OAEP) — supports

Read the thread · 2026-07-05 · closed · 0 comments

[kb] APC VerifyAuthRequestCryptogram: Visa (Scheme 0/CVN17) and Amex (Scheme 2) do not use ATC or UN

Contribution Type

apc_constraint

Target File

AGENTS.md — Key Constraints section

Source

aws-samples/samples-for-payment-cryptography-service migration_guidance/payshield-command-mapping.md (verified against source)

Content to Add

For VerifyAuthRequestCryptogram:

  • Visa (Scheme 0, VIS / CVN17) — MajorKeyDerivationMode=A, SessionKeyDerivation=Visa. "This algorithm does not use ATC or UN despite being mandatory fields in the payShield interface, hence they are not available i

Read the thread · 2026-07-05 · closed · 0 comments

[kb] BU (Generate a Key Check Value) upgraded: verified against PUGD0537-004 Rev A Core Host Commands — key-block form, KCV methods, authorization rule

Contribution Type

hsm_command

Target File

hsm_analysis.py — ALL_COMMANDS list

Source

apc-hsm-proxy hsm_probe (PR #46 / issue #15)

Content to Add

Update the existing BU entry (currently "EFTlab source — reference quality", confidence medium):

  • vendor/api: it is a payShield 10K Core host command — PUGD0537-004 Rev A, "Generate a check value for a key encrypted under an LMK pair" (BU, response BV) — not only an International/EFTlab reference.
  • confidence: high (verified agai

Read the thread · 2026-07-03 · closed · 0 comments

[kb] JU and KU (issuer-script MAC, mode 0) are now functional handlers in apc-hsm-proxy — add to _PROXY_HANDLERS thales_payshield

Contribution Type

proxy_handler

Target File

hsm_tools.py — _PROXY_HANDLERS dict

Source

apc-hsm-proxy issuer_script_mac.rs (PR #45, closes #24)

Content to Add

    "JU", "KU",                        # Issuer-script MAC (mode 0 integrity, via GenerateMac/EmvMac)

Context

Mode 0 (integrity) only: JU scheme '1' (UnionPay CUP 4.2) and KU schemes '0'/'1'/'2'/'5' (Visa VIS, Mastercard M/Chip, Amex AEIPS, JCB CVN04). Still gated: KY (IV-SMI/key-tree not modelled by APC EmvMac),

Read the thread · 2026-07-03 · closed · 0 comments

[kb] APC GenerateMac/EmvMac performs EMV issuer-script session-key derivation (IMK-SMI→SK-SMI); SessionKeyDerivationValue member is dictated by SessionKeyDerivationMode

Contribution Type

kb_entry

Target File

payment-knowledge-base.md

Source

apc-hsm-proxy issuer_script_mac handler (JU/KU mode 0, PR #45 / issue #24)

Content to Add

APC: GenerateMac EmvMac Derives Issuer-Script Session Keys (IMK-SMI → SK-SMI)

id: rule.apc-emvmac-issuer-script-session-key
entity_type: constraint_rule
canonical_name: APC GenerateMac EmvMac Performs Full Issuer-Script Session-Key Derivation
summary: >
  For EMV issuer-script (secure-messaging integrity) MA

[Read the thread](https://github.com/J8k3/aws-payment-cryptography-mcp/issues/16) · 2026-07-03 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/J8k3/aws-payment-cryptography-mcp/issues).