EMV Generate ARQC: add AES-256 E0 key support for APC cross-check

[J8k3]

Gap

EMV Generate ARQC uses AES-128 session keys (Option A derivation, AES-CMAC). AWS Payment Cryptography verify_auth_request_cryptogram rejects AES-128 E0 master keys — it requires AES-256 E0 keys. As a result, ARQC output cannot currently be cross-checked against APC.

APC cross-check status

❌ BLOCKED — APC rejects AES-128 E0 keys for this endpoint. CyberChef's AES-CMAC + Option A session-key derivation is standard-compliant; this is an APC key-size constraint.

Work required

1. Determine whether EMV Generate ARQC needs to support AES-256 master keys and AES-256 session key derivation
2. If yes: extend the operation to accept a 256-bit E0 key and derive accordingly
3. Create an AES-256 E0 key in APC, cross-check the ARQC output
4. Add cross-checked test vectors to Payment.mjs