generate_mac_emv_pin_change ¶

def generate_mac_emv_pin_change(
    self,
    new_pin_pek_identifier: "capo_payment_cryptography_data.types.key_arn_or_key_alias_type.KeyArnOrKeyAliasType",
    new_encrypted_pin_block: "capo_payment_cryptography_data.types.pin_block_length_equals16.PinBlockLengthEquals16",
    pin_block_format: "capo_payment_cryptography_data.types.pin_block_format_for_emv_pin_change.PinBlockFormatForEmvPinChange",
    secure_messaging_integrity_key_identifier: "capo_payment_cryptography_data.types.key_arn_or_key_alias_type.KeyArnOrKeyAliasType",
    secure_messaging_confidentiality_key_identifier: "capo_payment_cryptography_data.types.key_arn_or_key_alias_type.KeyArnOrKeyAliasType",
    message_data: "capo_payment_cryptography_data.types.command_message_data_type.CommandMessageDataType",
    derivation_method_attributes: "capo_payment_cryptography_data.types.derivation_method_attributes.DerivationMethodAttributes",
    *,
    config_overrides: Optional[PaymentCryptographyDataClientConfig] = None,
) -> "capo_payment_cryptography_data.types.generate_mac_emv_pin_change_output.GenerateMacEmvPinChangeOutput":
    """<p>Generates an issuer script mac for EMV payment cards that use offline PINs as the cardholder verification method (CVM).</p> <p>This operation generates an authenticated issuer script response by appending the incoming message data (APDU command) with the target encrypted PIN block in ISO2 format. The command structure and method to send the issuer script update to the card is not defined by this operation and is typically determined by the applicable payment card scheme.</p> <p>The primary inputs to this operation include the incoming new encrypted pinblock, PIN encryption key (PEK), issuer master key (IMK), primary account number (PAN), and the payment card derivation method.</p> <p>The operation uses two issuer master keys - secure messaging for confidentiality (IMK-SMC) and secure messaging for integrity (IMK-SMI). The SMC key is used to internally derive a key to secure the pin, while SMI key is used to internally derive a key to authenticate the script reponse as per the <a href="https://www.emvco.com/specifications/">EMV 4.4 - Book 2 - Security and Key Management</a> specification. </p> <p>This operation supports Amex, EMV2000, EMVCommon, Mastercard and Visa derivation methods, each requiring specific input parameters. Users must follow the specific derivation method and input parameters defined by the respective payment card scheme.</p> <note> <p>Use <a>GenerateMac</a> operation when sending a script update to an EMV card that does not involve PIN change. When assigning IAM permissions, it is important to understand that <a>EncryptData</a> using EMV keys and <a>GenerateMac</a> perform similar functions to this command.</p> </note> <p> <b>Cross-account use</b>: This operation supports cross-account use when the key has a resource-based policy that grants access. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/security_iam_resource-based-policies.html">Resource-based policies</a>.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>EncryptData</a> </p> </li> <li> <p> <a>GenerateMac</a> </p> </li> </ul>

    Args:
        new_pin_pek_identifier: <p>The <code>keyARN</code> of the PEK protecting the incoming new encrypted PIN block.</p>
        new_encrypted_pin_block: <p>The incoming new encrypted PIN block data for offline pin change on an EMV card.</p>
        pin_block_format: <p>The PIN encoding format of the incoming new encrypted PIN block as specified in ISO 9564.</p>
        secure_messaging_integrity_key_identifier: <p>The <code>keyARN</code> of the issuer master key (IMK-SMI) used to authenticate the issuer script response.</p>
        secure_messaging_confidentiality_key_identifier: <p>The <code>keyARN</code> of the issuer master key (IMK-SMC) used to protect the PIN block data in the issuer script response.</p>
        message_data: <p>The message data is the APDU command from the card reader or terminal. The target encrypted PIN block, after translation to ISO2 format, is appended to this message data to generate an issuer script response.</p>
        derivation_method_attributes: <p>The attributes and data values to derive payment card specific confidentiality and integrity keys.</p>

    Raises:
        capo_payment_cryptography_data.errors.access_denied_exception.AccessDeniedException: <p>You do not have sufficient access to perform this action.</p>
        capo_payment_cryptography_data.errors.internal_server_exception.InternalServerException: <p>The request processing has failed because of an unknown error, exception, or failure.</p>
        capo_payment_cryptography_data.errors.resource_not_found_exception.ResourceNotFoundException: <p>The request was denied due to an invalid resource error.</p>
        capo_payment_cryptography_data.errors.throttling_exception.ThrottlingException: <p>The request was denied due to request throttling.</p>
        capo_payment_cryptography_data.errors.validation_exception.ValidationException: <p>The request was denied due to an invalid request error.</p>
        capo_payment_cryptography_data.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_payment_cryptography_data.types.generate_mac_emv_pin_change_input.GenerateMacEmvPinChangeInput]",
    ) -> OperationResponse[
        "capo_payment_cryptography_data.types.generate_mac_emv_pin_change_output.GenerateMacEmvPinChangeOutput"
    ]:
        import capo_payment_cryptography_data._operations.payment_cryptography_data_plane.generate_mac_emv_pin_change

        output, http_response = (
            capo_payment_cryptography_data._operations.payment_cryptography_data_plane.generate_mac_emv_pin_change.generate_mac_emv_pin_change(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_payment_cryptography_data.types.generate_mac_emv_pin_change_input.GenerateMacEmvPinChangeInput",
    ) -> dict[str, Any]:
        import capo_payment_cryptography_data.types.generate_mac_emv_pin_change_input

        return capo_payment_cryptography_data.types.generate_mac_emv_pin_change_input.redact_sensitive(
            input_
        )

    def _redact_output(
        output: "capo_payment_cryptography_data.types.generate_mac_emv_pin_change_output.GenerateMacEmvPinChangeOutput",
    ) -> dict[str, Any]:
        import capo_payment_cryptography_data.types.generate_mac_emv_pin_change_output

        return capo_payment_cryptography_data.types.generate_mac_emv_pin_change_output.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "GenerateMacEmvPinChange",
            redact_input=_redact_input,
            redact_output=_redact_output,
        ),
    )
    input_: capo_payment_cryptography_data.types.generate_mac_emv_pin_change_input.GenerateMacEmvPinChangeInput = {
        "new_pin_pek_identifier": new_pin_pek_identifier,
        "new_encrypted_pin_block": new_encrypted_pin_block,
        "pin_block_format": pin_block_format,
        "secure_messaging_integrity_key_identifier": secure_messaging_integrity_key_identifier,
        "secure_messaging_confidentiality_key_identifier": secure_messaging_confidentiality_key_identifier,
        "message_data": message_data,
        "derivation_method_attributes": derivation_method_attributes,
    }

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output