Data-encrypting keys

Data-encrypting keys are used to encrypt and decrypt data.

DATA class keys can be either encrypted under the master key or in the clear. CIPHER class are encrypted under the master key.

Table 1. DES data-encrypting keys
DES keys Callable services
DATA class (data operation keys):
  • These key are used to encrypt and decrypt data.
  • Single-length keys can be used to generate and verify MACs and CVVs.
  • DATA keys can be single-length, double-length, or triple-length.
  • DATAM and DATAMV keys are double-length.
  • The DATA key value may be encrypted or clear. All other keys are encrypted.
DATA (encrypted) Authentication Parameter Generate, Cipher Text Translate2, CVV Key Combine, Decipher, Encipher, MAC Generate, MAC Verify, VISA CVV Generate, VISA CVV Verify
DATA (encrypted or clear) Symmetric Key Encipher, Symmetric Key Decipher
DATAM MAC Generate, MAC Verify
DATAMV MAC Verify
Cipher class (data operation keys):
  • These key are used to encrypt and decrypt data.
  • The keys can be single-length, double-length, or triple-length.
CIPHER Cipher Text Translate2, Decipher, Encipher
DECIPHER Cipher Text Translate2, Decipher
ENCIPHER Cipher Text Translate2, Encipher
Availability notes: Triple-length DES keys require z13 or z13s or later servers with the July 2019 or later licensed internal code (LIC) or z14 or later servers with the December 2018 or later licensed internal code (LIC).
Table 2. AES data-encrypting keys
AES keys Callable services
DATA class (data operation keys):
  • These key are used to encrypt and decrypt data.
  • Clear keys can be used to generate and verify MACs.
  • The keys can be 128, 192, or 256 bits in length.
  • The key value may be encrypted or clear.
DATA (encrypted) Cipher Text Translate2, Symmetric Algorithm Decipher, Symmetric Algorithm Encipher, Symmetric Key Decipher, Symmetric Key Encipher
DATA (clear) Symmetric Key Decipher, Symmetric Key Encipher, Symmetric MAC Generate, Symmetric MAC Verify
Cipher class (data operation keys):
  • These key are used to encrypt and decrypt data.
  • The keys can be 128, 192, or 256 bits in length.
  • The key usage flags in the associated data can be used to restrict usage to encipher only or decipher only.
CIPHER Cipher Text Translate2, Symmetric Algorithm Decipher, Symmetric Algorithm Encipher, Symmetric Key Decipher, Symmetric Key Encipher
Availability notes: AES Cipher class keys require z114, z196, or later systems with a CEX3C or later coprocessor with the September 2011 or later licensed internal code (LIC).