Reference information

The provided reference information informs about key formats, cryptographic algorithms, as well as return and reason codes when you program with CCA.

Return codes and reason codes
Read the contained reference information that describes the return codes and reason codes reported at the conclusion of verb processing.
Key token formats
The key token formats can be useful for debugging purposes.
Key forms and types used in the Key Generate verb
The Key Generate verb is the most complex of all the CCA verbs. You can generate different key forms and key types with the Key Generate verb.
Key-record-list datasets and records
There is a different verb for each of the four key storage datasets. There is one for the AES key-store, one for the DES key-store, one for the PKA key-store, and one for the combined key storage (CMB) (which works with all key token types: CCA AES, CCA DES, CCA PKA, and TR-31).
Control vectors and changing control vectors with the Control Vector Translate verb
A control vector table shows the default value of the control vector associated with each type of key.
Key type vectors
The values of the keys that are calculated while diversification depend on their intended key usage. Therefore, a DK key type vector (KTV) is being introduced to define how to generate or derive (Diversify Directed Key) the intended AES variable-length symmetric key. The KTV is a parameter that defines the rules for the key to be generated or derived. It also contains information that is needed by the HSM to restrict the usage of the key to be generated or derived.
PIN formats and algorithms
Personal identification number (PIN) notation, PIN block formats, PIN extraction rules, and PIN algorithms.
Cryptographic algorithms and processes
CCA algorithms and processes include key verification algorithms, data-encryption processes, as well as key format and encryption processes.
Access control points and verbs
Verbs use access control points (ACPs). ACPs are also referred to as commands.
Access control data structures
Learn about the data structures that are used in the access control system. You can also view examples of the access-control data structures
Using verbs and applications in PCI-HSM 2016 compliance mode
Beginning with the Crypto Express6 adapter, when configured as a CCA coprocessor, such a coprocessor is capable of running in the PCI-HSM 2016 compliance mode. In order for the requirements of PCI-HSM 2016 to apply to a workload, the workload must be using compliant-tagged key tokens.
AES-DUKPT reference
Read the contained information about the use of AES keys with derived unique key per transaction (AES-DUKPT) processing.
Sample verb call routines
This topic contains sample verb call routines for both C and Java™.
Initial system set-up tips
Use these tips to help you set up your system for the first time.
CCA installation instructions
Use these instructions when you install or configure CCA release 8.0.
Coexistence of CEX8C and previous CEX*C features
While CEX8C is only supported on processors starting with IBM z16, and CEX7S coprocessors are supported on processors starting with IBM IBM z15™, the CCA 8.0 RPM is also useful on IBM z14® and other legacy systems. This information unit discusses co-existence considerations for the CCA 8.0 RPM.
Utilities
You can use a utility to verify an installation. An additional utility is available to administer cryptographic coprocessors in setups without a TKE workstation.
Security API command and sub-command codes
View an alphabetical list of security API command and sub-command codes returned by the output rule-array for option STATDIAG of the Cryptographic Facility Query verb.
openCryptoki support
openCryptoki is an open source implementation of the Cryptoki API as defined by the industry-wide PKCS #11 Cryptographic Token Interface Standard.
List of abbreviations
A list of abbreviations used in this document.

Parent topic: Secure Key Solution with the Common Cryptographic Architecture Programmer's Guide