If the non-CCF system has coprocessors (CEX3C or later) with
the September, 2011 LIC or later, do the following steps:
- Load the value of the CCF KMMK master key into the new RSA-MK
register. You will need the checksum.
- Set the RSA-MK using the SET MK utility.
If the non-CCF system has coprocessors (CEX3C or earlier)
without the September, 2011 LIC, do the following steps:
- Load the value of the CCF KMMK master key into the new RSA-MK
register. You will need the checksum. The RSA-MK is automatically
set when the final key part is loaded.
- Enable the PKA Callable Services and Dynamic PKDS Access controls.
The current RSA-MK now has the same value as the SMK/KMMK on the CCF.