Start of change

External key management

IBM i Cryptographic Services integrates with IBM Key Protect for IBM Cloud to provide external key management, enabling cloud-managed keys to work alongside the existing local key management infrastructure.

IBM Key Protect for IBM Cloud is the supported external key manager for IBM i Cryptographic Services. Key Protect stores keys in FIPS 140-2 certified cloud-based hardware security modules (HSMs), providing a secure alternative to managing all key material locally on the system.

The integration supports several use cases. AES keys from a local keystore file can be exported to Key Protect, or wrapped locally using a root key held in Key Protect. Master key parts can be loaded directly from Key Protect, enabling cloud-managed bring your own key (BYOK) support for IBM i master keys. Key Protect keys and wrapped key material can be used with the following Cryptographic Services encryption, decryption, and authentication APIs:

  • Create Key Context (OPM, QC3CRTKX; ILE, Qc3CreateKeyContext) API
  • Encrypt Data (OPM, QC3ENCDT; ILE, Qc3EncryptData) API
  • Decrypt Data (OPM, QC3DECDT; ILE, Qc3DecryptData) API
  • Encrypt with MAC (OPM, QC3ENCWM; ILE, Qc3EncryptWithMac) API
  • Decrypt with MAC (OPM, QC3DECWM; ILE, Qc3DecryptWithMac) API
  • Calculate MAC (OPM, QC3CALMA; ILE, Qc3CalculateMac) API

For more information on using IBM Key Protect for IBM Cloud, see the IBM Cloud Key Protect documentation.

End of change