Special notes

1. Several import situations might require keywords. Keywords are ignored for INCL-CV scenarios unless they directly conflict with the included control vector. For example, the verb returns an error if the control vector indicates that a DKYGENKY key has a subtype of DKYL0 and the user specifies the DKYL1 keyword.
2. Be aware of the interaction of ACP X'0158' (T31X - Permit any CCA key if INCL-CV is specified) with the INCL-CV keyword for the TR31 Translate verb. Without the INCL-CV keyword specified, most export translations are guarded by key-type specific ACPs. These ACPs are used to guard the source CCA system against attacks involving reimport of the exported key under ambiguous circumstances. When the control vector is exported in an optional block along with the key, it is securely bound to the encrypted key. This somewhat protects the source system because the key on import is allowed to have only the form of the included control vector. Expansion of capability is blocked. If ACP X'0158' is not enabled in the active role, the type-specific ACPs are still required. However, if ACP X'0158' is enabled, the key-type specific ACPs are not checked when INCL-CV is specified.
3. Be aware of ACP X'017C' (TR31 Import - Permit V0/V1/V2:N to PINGEN/PINVER) for import of PINGEN or PINVER keys with key usage V0, V1, V2, and mode N.

The extra translation-specific ACPs are intended to enable control of situations where the CCA imported key type is ambiguous based on the TR-31 key attributes. This ambiguity is never the case when INCL-CV has been specified with the TR31 Translate verb, which ensures that the imported TR-31 key block has a valid CV to precisely control the resultant CCA key. Therefore, there are no translation-specific ACPs governing INCL-CV import translations.