ReEncryptData

Source: src/AWS/PaymentCryptography/ReEncryptData.ts

Runtime binding for payment-cryptography:ReEncryptData — decrypts ciphertext under the incoming Key and re-encrypts it under the outgoing Key entirely inside the service; the plaintext never leaves AWS Payment Cryptography. At least one side must be a DUKPT Base Derivation Key or a dynamic (TR-31 wrapped) key — the service rejects plain symmetric-to-symmetric re-encryption with ValidationException: KeyUsages not allowed for this operation. Provide ReEncryptDataHttp on the Function to satisfy this service.

Re-Encrypting Data

// init — incoming BDK, outgoing symmetric data key
const reEncrypt = yield* PaymentCryptography.ReEncryptData(bdk, workingKey);

// runtime
const translated = yield* reEncrypt({
  CipherText: dukptCipherTextHex,
  IncomingEncryptionAttributes: {
    Dukpt: { KeySerialNumber: ksn, Mode: "CBC" },
  },
  OutgoingEncryptionAttributes: {
    Symmetric: { Mode: "CBC", InitializationVector: iv },
  },
});