本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
创建密钥
您可以使用 CreateKey API 操作创建 AWS 支付加密密钥。创建密钥时，需要指定诸如密钥算法、密钥用法、允许的操作以及密钥是否可导出等属性。创建 AWS 付款加密密钥后，您无法更改这些属性。
注意
如果您启用了多区域密钥复制， AWS 账户 并且您创建了支付加密密钥，则该密钥将自动成为主区域密钥 (PR K)。即使您未在CreateKey命令中指定--replication-regions参数，也会复制 PRK。有关更多信息，请参阅 多区域密钥复制的工作原理。
创建 3KEY TDES 基础派生密钥
此命令创建一个 3KEY TDES 派生密钥，该密钥将复制到美国东部（俄亥俄州）和美国西部（俄勒冈）区域。响应包括请求参数、后续调用的 Amazon 资源名称 (ARN) 和密钥检查值 (KCV)。
$aws payment-cryptography create-key --exportable --key-attributes \ "KeyUsage=TR31_B0_BASE_DERIVATION_KEY, \ KeyClass=SYMMETRIC_KEY,KeyAlgorithm=TDES_3KEY, \ KeyModesOfUse={NoRestrictions=true}" \ --replication-regions us-east-2 --region us-west-2
输出示例：
{ "Key": { "CreateTimestamp": "2022-10-26T16:04:11.642000-07:00", "Enabled": true, "Exportable": true, "KeyArn": "FE23D3", "KeyAttributes": { "KeyAlgorithm": "TDES_3KEY", "KeyClass": "SYMMETRIC_KEY", "KeyModesOfUse": { "Decrypt": false, "DeriveKey": true, "Encrypt": false, "Generate": false, "NoRestrictions": false, "Sign": false, "Unwrap": false, "Verify": true, "Wrap": false }, "KeyUsage": "TR31_B0_BASE_DERIVATION_KEY" }, "KeyCheckValue": "FE23D3", "KeyCheckValueAlgorithm": "ANSI_X9_24", "KeyOrigin": "AWS_PAYMENT_CRYPTOGRAPHY", "KeyState": "CREATE_COMPLETE", "UsageStartTimestamp": "2022-10-26T16:04:11.559000-07:00" }
为 CVV/ 创建 2KEY TDES 密钥 CVV2
此命令创建一个 2KEY TDES 密钥，用于生成和验证 CVVCVV2/值。响应包括请求参数、后续调用的 Amazon 资源名称 (ARN) 和密钥检查值 (KCV)。
$aws payment-cryptography create-key --exportable --key-attributes KeyAlgorithm=TDES_2KEY, \ KeyUsage=TR31_C0_CARD_VERIFICATION_KEY,KeyClass=SYMMETRIC_KEY, \ KeyModesOfUse='{Generate=true,Verify=true}'
输出示例：
{ "Key": { "CreateTimestamp": "2022-10-26T16:04:11.642000-07:00", "Enabled": true, "Exportable": true, "KeyArn": "arn:aws:payment-cryptography:us-east-2::key/7f7g4spf3xcklhzu", "KeyAttributes": { "KeyAlgorithm": "TDES_2KEY", "KeyClass": "SYMMETRIC_KEY", "KeyModesOfUse": { "Decrypt": false, "DeriveKey": false, "Encrypt": false, "Generate": true, "NoRestrictions": false, "Sign": false, "Unwrap": false, "Verify": true, "Wrap": false }, "KeyUsage": "TR31_C0_CARD_VERIFICATION_KEY" }, "KeyCheckValue": "AEA5CD", "KeyCheckValueAlgorithm": "ANSI_X9_24", "KeyOrigin": "AWS_PAYMENT_CRYPTOGRAPHY", "KeyState": "CREATE_COMPLETE", "UsageStartTimestamp": "2022-10-26T16:04:11.559000-07:00" } }
创建 PIN 加密密钥 (PEK)
此命令创建用于加密 PIN 值的 3KEY TDES 密钥。 PINs 在验证期间（例如在交易中），您可以使用此密钥安全地存储 PINs 或解密。响应包括请求参数、后续调用的 ARN 和 KCV。
$aws payment-cryptography create-key --exportable --key-attributes \ KeyAlgorithm=TDES_3KEY,KeyUsage=TR31_P0_PIN_ENCRYPTION_KEY, \ KeyClass=SYMMETRIC_KEY,KeyModesOfUse='{Encrypt=true,Decrypt=true,Wrap=true,Unwrap=true}'
输出示例：
{ "Key": { "CreateTimestamp": "2022-10-27T08:27:51.795000-07:00", "Enabled": true, "Exportable": true, "KeyArn": "arn:aws:payment-cryptography:us-east-2::key/ivi5ksfsuplneuyt", "KeyAttributes": { "KeyAlgorithm": "TDES_3KEY", "KeyClass": "SYMMETRIC_KEY", "KeyModesOfUse": { "Decrypt": true, "DeriveKey": false, "Encrypt": true, "Generate": false, "NoRestrictions": false, "Sign": false, "Unwrap": true, "Verify": false, "Wrap": true }, "KeyUsage": "TR31_P0_PIN_ENCRYPTION_KEY" }, "KeyCheckValue": "7CC9E2", "KeyCheckValueAlgorithm": "ANSI_X9_24", "KeyOrigin": "AWS_PAYMENT_CRYPTOGRAPHY", "KeyState": "CREATE_COMPLETE", "UsageStartTimestamp": "2022-10-27T08:27:51.753000-07:00" } }
创建非对称 (RSA) 密钥
此命令生成一个新的非对称 RSA 2048 位密钥对。它会创建一个新的私钥及其匹配的公钥。您可以使用 getPublicCertificateAPI 检索公钥。
$aws payment-cryptography create-key --exportable \ --key-attributes KeyAlgorithm=RSA_2048,KeyUsage=TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION, \ KeyClass=ASYMMETRIC_KEY_PAIR,KeyModesOfUse='{Encrypt=true, Decrypt=True,Wrap=True,Unwrap=True}'
输出示例：
{ "Key": { "CreateTimestamp": "2022-11-15T11:15:42.358000-08:00", "Enabled": true, "Exportable": true, "KeyArn": "arn:aws:payment-cryptography:us-east-2::key/nsq2i3mbg6sn775f", "KeyAttributes": { "KeyAlgorithm": "RSA_2048", "KeyClass": "ASYMMETRIC_KEY_PAIR", "KeyModesOfUse": { "Decrypt": true, "DeriveKey": false, "Encrypt": true, "Generate": false, "NoRestrictions": false, "Sign": false, "Unwrap": true, "Verify": false, "Wrap": true }, "KeyUsage": "TR31_D1_ASYMMETRIC_KEY_FOR_DATA_ENCRYPTION" }, "KeyCheckValue": "40AD487F", "KeyCheckValueAlgorithm": "SHA-1", "KeyOrigin": "AWS_PAYMENT_CRYPTOGRAPHY", "KeyState": "CREATE_COMPLETE", "UsageStartTimestamp": "2022-11-15T11:15:42.182000-08:00" } }
创建 PIN 验证值 (PVV) 密钥
此命令创建用于生成 PVV 值的 3KEY TDES 密钥。您可以使用此密钥生成可与随后计算出的 PVV 进行比较的 PVV。响应包括请求参数、后续调用的 ARN 和 KCV。
$aws payment-cryptography create-key --exportable \ --key-attributes KeyAlgorithm=TDES_3KEY,KeyUsage=TR31_V2_VISA_PIN_VERIFICATION_KEY, \ KeyClass=SYMMETRIC_KEY,KeyModesOfUse='{Generate=true,Verify=true}'
输出示例：
{ "Key": { "CreateTimestamp": "2022-10-27T10:22:59.668000-07:00", "Enabled": true, "Exportable": true, "KeyArn": "arn:aws:payment-cryptography:us-east-2::key/37y2tsl45p5zjbh2", "KeyAttributes": { "KeyAlgorithm": "TDES_3KEY", "KeyClass": "SYMMETRIC_KEY", "KeyModesOfUse": { "Decrypt": false, "DeriveKey": false, "Encrypt": false, "Generate": true, "NoRestrictions": false, "Sign": false, "Unwrap": false, "Verify": true, "Wrap": false }, "KeyUsage": "TR31_V2_VISA_PIN_VERIFICATION_KEY" }, "KeyCheckValue": "7F2363", "KeyCheckValueAlgorithm": "ANSI_X9_24", "KeyOrigin": "AWS_PAYMENT_CRYPTOGRAPHY", "KeyState": "CREATE_COMPLETE", "UsageStartTimestamp": "2022-10-27T10:22:59.614000-07:00" } }
创建非对称 ECC 密钥
此命令生成 ECC 密钥对，用于在双方之间建立 ECDH（Elliptic Curve Diffie-Hellman）密钥协议。使用 ECDH，各方生成自己的 ECC 密钥对，其中包含密钥用途 K3 和使用模式 X，然后交换公钥。然后，双方使用其私钥和收到的公钥来建立共享派生密钥。
为了保持支付中加密密钥的一次性使用原则，我们建议不要将ECC密钥对重复用于多种用途，例如ECDH密钥派生和签名。
$aws payment-cryptography create-key --exportable \ --key-attributes KeyAlgorithm=ECC_NIST_P256,KeyUsage=TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT, \ KeyClass=ASYMMETRIC_KEY_PAIR,KeyModesOfUse='{DeriveKey=true}'
输出示例：
{ "Key": { "CreateTimestamp": "2024-10-17T01:31:55.908000+00:00", "Enabled": true, "Exportable": true, "KeyArn": "arn:aws:payment-cryptography:us-east-2::key/wc3rjsssguhxtilv", "KeyAttributes": { "KeyAlgorithm": "ECC_NIST_P256", "KeyClass": "ASYMMETRIC_KEY_PAIR", "KeyModesOfUse": { "Decrypt": false, "DeriveKey": true, "Encrypt": false, "Generate": false, "NoRestrictions": false, "Sign": false, "Unwrap": false, "Verify": false, "Wrap": false }, "KeyUsage": "TR31_K3_ASYMMETRIC_KEY_FOR_KEY_AGREEMENT" }, "KeyCheckValue": "", "KeyCheckValueAlgorithm": "SHA-1", "KeyOrigin": "AWS_PAYMENT_CRYPTOGRAPHY", "KeyState": "CREATE_COMPLETE", "UsageStartTimestamp": "2024-10-17T01:31:55.866000+00:00" } }
