z/OS Cryptographic Services ICSF Application Programmer's Guide
Previous topic | Next topic | Contents | Index | Contact z/OS | Library | PDF


Usage Notes

z/OS Cryptographic Services ICSF Application Programmer's Guide
SA22-7522-16

There are access control points that control use of the format rule array keys and the type of transport keys that can be used. All of these access control points are enabled in the default role.

PKA Key Translate - from CCA RSA to SCVISA Format
PKA Key Translate - from CCA RSA to SC ME Format
PKA Key Translate - from CCA RSA to SC CRT Format
PKA Key Translate - from source EXP KEK to target EXP KEK
PKA Key Translate - from source IMP KEK to target EXP KEK
PKA Key Translate - from source IMP KEK to target IMP KEK

This service requires at least one of the following access control points to be enabled in the ICSF role.

Table 239. Required access control points for PKA Key Translate
Smartcard formatAccess control point
SCVISAPKA Key Translate - from CCA RSA to SC Visa Format
SCCOMMEPKA Key Translate - from CCA RSA to SC ME Format
SCCOMCRTPKA Key Translate - from CCA RSA to SC CRT Format

These access control points must be enabled to allow the key type combination shown in this table.

Table 240. Required access control points for source/target transport key combinations
Source transport key typeTarget transport key typeAccess control point
EXPORTEREXPORTERPKA Key Translate - from source EXP KEK to target EXP KEK
IMPORTEREXPORTERPKA Key Translate - from source IMP KEK to target EXP KEK
IMPORTERIMPORTERPKA Key Translate - from source IMP KEK to target IMP KEK
EXPORTERIMPORTER(Not allowed)

This table lists the required cryptographic hardware for each server type and describes restrictions for this callable service.

Table 241. PKA key translate required hardware
ServerRequired Cryptographic hardwareRestrictions
IBM eServer zSeries 900Not supported on this platform.
IBM eServer zSeries 990

IBM eServer zSeries 890

Not supported on this platform.
IBM System z9 EC

IBM System z9 BC

Crypto Express2 Coprocessor

Requires the Apr. 2009 or later licensed internal code (LIC).

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014