This topic describes the callable services for creating and maintaining PKCS #11 tokens and objects. ICSF provides a number of callable services to assist you in managing PKCS #11 tokens and maintaining the token data set (TKDS). Services are also provided for generating, using, and managing key objects.

The following callable services are described:

• PKCS #11 Derive multiple keys (CSFPDMK and CSFPDMK6)
• PKCS #11 Derive key (CSFPDVK and CSFPDVK6)
• PKCS #11 Get attribute value (CSFPGAV and CSFPGAV6)
• PKCS #11 Generate key pair (CSFPGKP and CSFPGKP6)
• PKCS #11 Generate secret key (CSFPGSK and CSFPGSK6)
• PKCS #11 Generate HMAC (CSFPHMG and CSFPHMG6)
• PKCS #11 Verify HMAC (CSFPHMV and CSFPHMV6)
• PKCS #11 One-way hash, sign, or verify (CSFPOWH and CSFPOWH6)
• PKCS #11 Private key sign (CSFPPKS and CSFPPKS6)
• PKCS #11 Public key verify (CSFPPKV and CSFPPKV6)
• PKCS #11 Pseudo-random function (CSFPPRF and CSFPPRF6)
• PKCS #11 Set attribute value (CSFPSAV and CSFPSAV6)
• PKCS #11 Secret key decrypt (CSFPSKD and CSFPSKD6)
• PKCS #11 Secret key encrypt (CSFPSKE and CSFPSKE6)
• PKCS #11 Token record create (CSFPTRC and CSFPTRC6)
• PKCS #11 Token record delete (CSFPTRD and CSFPTRD6)
• PKCS #11 Token record list (CSFPTRL and CSFPTRL6)
• PKCS #11 Unwrap key (CSFPUWK and CSFPUWK6)
• PKCS #11 Wrap key (CSFPWPK and CSFPWPK6)

As of ICSF FMID HCR7770, a TKDS is no longer required to use the PKCS #11 services. If ICSF is started without a TKDS, however, only the omnipresent token will be available. The omnipresent token supports session objects only. Session objects are objects that do not persist beyond the life of a PKCS #11 session.