Cloud Payment Processing with AWS Payment Cryptography - Cryptographic Key Management and PIN Verification
Learn how Payment Cryptography manages payment cryptographic keys, encrypts and decrypts PIN blocks, and achieves PCI DSS compliance.
Overview of Payment Cryptography
Payment Cryptography is a service that provides cloud-based cryptographic key management and encryption operations for payment processing, compliant with PCI PIN Security and PCI P2PE. Traditionally, payment encryption required on-premises HSMs (such as Thales payShield or Futurex), but Payment Cryptography enables migration to the cloud. It is compliant with PCI PIN Security Requirements and PCI P2PE.
Payment Encryption Operations
The Control Plane API manages the creation, import, and export of AES-128/256, TDES, and RSA-2048/4096 cryptographic keys, while the Data Plane API executes encryption operations. PIN Translation re-encrypts a PIN block encrypted with the acquirer's key using the issuer's key, and is used in payment network switching. CVV generation and verification are used during card issuance and payment authorization, computing a cryptographic verification value from the card number and expiration date. Keys can be imported and exported in TR-31 key block format, enabling key exchange with other HSMs and payment networks.
Key Management and Payment Network Integration
Payment Cryptography supports payment-specific key types such as BDK (Base Derivation Key), IPEK (Initial PIN Encryption Key), and KEK (Key Encryption Key). Keys are imported and exported in TR-31 key block format to ensure interoperability with existing payment infrastructure. DUKPT (Derived Unique Key Per Transaction) derives a unique key for each transaction, minimizing the risk of key compromise. Encryption operations required by Visa, Mastercard, and American Express payment networks (PIN block conversion, MAC generation and verification) can be performed in the cloud. For a comprehensive guide to Payment Cryptography best practices, check out related books on Amazon.
Payment Cryptography Pricing
Payment Cryptography pricing consists of key management (approximately $1 per key per month) and encryption operations (approximately $0.85 per 10,000 operations). Compared to on-premises HSMs (hardware purchase, data center installation, maintenance contracts), there is no upfront investment and pay-as-you-go pricing enables cost management based on transaction volume. PCI DSS compliance maintenance costs (annual audits, penetration testing) can also be reduced through cloud migration. For low transaction volumes, the fixed cost of key management becomes the primary cost factor.
Summary
Payment Cryptography is a service that provides cloud-based cryptographic key management and encryption operations for payment processing. It supports DUKPT and TR-31 key blocks in a PCI-compliant environment, and performs PIN block conversion and MAC generation/verification. It eliminates the need to purchase, install, and maintain on-premises HSMs, and enables cost management based on transaction volume through pay-as-you-go pricing.