SAF may be invoked to verify the caller is authorized to use this callable service, the key label, or internal secure key tokens that are stored in the CKDS or PKDS.

When the SET Block Decompose service is invoked without the DES-ONLY keyword, the DES key is retrieved from the RSA-OAEP block and returned in the key token contained in the DES_key_block. On subsequent calls to the SET Block Decompose service, a caller can re-use the DES key. The caller of the service must supply the DES_key_block, the DES_key_block_length, the DES_encrypted_data_block, the DES_encrypted_data_block_length, the initialization and chaining vectors, and the rule_array keywords SET1.00 and DES-ONLY. The RSA private key information, RSA-OAEP block and length, XData string and length, and hash block and length need not be supplied (although the parameters must still be specified). For this invocation, the decryption of the RSA-OAEP block is bypassed; only DES decryption is performed, using the supplied DES key.

When the SET Block Decompose service is invoked with the PINBLOCK keyword, DES-ONLY may not also be specified. If both of these rule array keywords are specified, the service will fail. If PINBLOCK is specified and the DES_key_block_length field is not 128, the service will fail.

The SET Block Decompose access control point controls the function of this service. If a PIN-block encrypting key is supplied in the DES_key_block, the access control point matching the key type of the key must be enabled in the ICSF role.

This table lists the required cryptographic hardware for each server type and describes restrictions for this callable service.

Table 214. SET block decompose required hardware

Server	Required cryptographic hardware	Restrictions
IBM zSeries 900	Cryptographic Coprocessor Feature	If there is no PCI Cryptographic Coprocessor available, the request will be processed on the Cryptographic Coprocessor Feature.
	PCI Cryptographic Coprocessor	A PCI Cryptographic Coprocessor is required if: the RSA_private_key_identifier specifies a retained private key the RSA_private_key_identifier specifies a CRT private key the PINBLOCK rule array keyword is specified The service has a preference for being processed on a PCI Cryptographic Coprocessor so that the symmetric key does not appear in the clear.
IBM zSeries 990 IBM zSeries 890	PCI X Cryptographic Coprocessor Crypto Express2 Coprocessor
IBM System z9 EC IBM System z9 BC	Crypto Express2 Coprocessor