Edition November 2023, CCA Support Program Release 8.1
This edition describes the IBM® CCA Basic Services API for Release 8.1.
With CCA Release 8.1, the following enhancements are provided:
- Updates for TR-31 key block support:
- Support was added to build, send, receive, and use TR-31 key blocks directly in most of the CCA services that utilize symmetric keys.
- A new verb was added to build TR-31 key blocks: TR31 Key Create (CSNBT31C).
- TR-31 tokens can be stored in the newly created CMB key storage.
- A new combined key storage (CMB) is available:
- The combined key storage was designed to support all key types: AES, HMAC, DES, and PKA (ECC, RSA, and QSA, that is, CRYSTALS-Dilithium and CRYSTALS-Kyber keys).
- Additionally, the CMB key storage supports both CCA and TR-31 key token formats.
- Keys can be added to the CMB key storage by creating them directly in the CMB or by migrating existing AES, HMAC, DES, and PKA keys into the CMB from their respective type-specific key stores.
- SHA-3 support has been added:
- CCA can now perform the SHA-3 hashing algorithm, specifically for the CSNBOWH, CSNDDSG, and CSNDDSV verbs.
- In addition, on IBM z14® or later systems, SHA-3 requests can be forwarded to the CPACF for processing.
- Support for OAEP 2.1 has been added:
- CCA now offers the ability to utilize OAEP version 2.1 in the verbs CSNDPKE and CSNDPKD.
- This update enables the usage of three additional SHA algorithms with OAEP: SHA-224, SHA-384, and SHA-512.
The CCA API includes the following new verbs:
| Verb | Service name | Category |
|---|---|---|
| CSNBCKRC | Combined Key Record Create (CSNBCKRC) | Key storage mechanisms |
| CSNBCKRD | Combined Key Record Delete (CSNBCKRD) | Key storage mechanisms |
| CSNBCKRL | Combined Key Record List (CSNBCKRL) | Key storage mechanisms |
| CSNBCKRR | Combined Key Record Read (CSNBCKRR) | Key storage mechanisms |
| CSNBCKRW | Combined Key Record Write (CSNBCKRW) | Key storage mechanisms |
| CSNBT31C | TR31 Key Create (CSNBT31C) | TR-31 symmetric key management |
The following verbs provide new or updated keywords or other updated information:
| Verb | Service name | Category |
|---|---|---|
| CSUACFQ | Cryptographic Facility Query (CSUACFQ) | Using CCA nodes and resource control verbs |
| CSNBKSI | Key Storage Initialization (CSNBKSI) | Using CCA nodes and resource control verbs |
| CSNBDKX | Data Key Export (CSNBDKX) | Managing AES, DES and HMAC cryptographic keys |
| CSNBDKM | Data Key Import (CSNBDKM) | Managing AES, DES and HMAC cryptographic keys |
| CSNBDKG | Diversified Key Generate (CSNBDKG) | Managing AES, DES and HMAC cryptographic keys |
| CSNBDKG2 | Diversified Key Generate2 (CSNBDKG2) | >Managing AES, DES and HMAC cryptographic keys |
| CSNDEDH | EC Diffie-Hellman (CSNDEDH) | Managing AES, DES and HMAC cryptographic keys |
| CSNBKEX | Key Export (CSNBKEX) | Managing AES, DES and HMAC cryptographic keys |
| CSNBKGN | Key Generate (CSNBKGN) | Managing AES, DES and HMAC cryptographic keys |
| CSNBKGN2 | Key Generate2 (CSNBKGN2) | Managing AES, DES and HMAC cryptographic keys |
| CSNBKIM | Key Import (CSNBKIM) | Managing AES, DES and HMAC cryptographic keys |
| CSNBKPI2 | Key Part Import2 (CSNBKPI2) | Managing AES, DES and HMAC cryptographic keys |
| CSNBKYT2 | Key Test2 (CSNBKYT2) | Managing AES, DES and HMAC cryptographic keys |
| CSNBKTC2 | Key Token Change2 (CSNBKTC2) | Managing AES, DES and HMAC cryptographic keys |
| CSNBKTR2 | Key Translate2 (CSNBKTR2) | Managing AES, DES and HMAC cryptographic keys |
| CSNDPKD | PKA Decrypt (CSNDPKD) | Managing AES, DES and HMAC cryptographic keys |
| CSNDPKE | PKA Encrypt (CSNDPKE) | Managing AES, DES and HMAC cryptographic keys |
| CSNBRKA | Restrict Key Attribute (CSNBRKA) | Managing AES, DES and HMAC cryptographic keys |
| CSNBRNGL | Random Number Generate Long (CSNBRNGL) | Managing AES, DES and HMAC cryptographic keys |
| CSNDSYX | Symmetric Key Export (CSNDSYX) | Managing AES, DES and HMAC cryptographic keys |
| CSNDSXD | Symmetric Key Export with Data (CSNDSXD) | Managing AES, DES and HMAC cryptographic keys |
| CSNDSYG | Symmetric Key Generate (CSNDSYG) | Managing AES, DES and HMAC cryptographic keys |
| CSNDSYI2 | Symmetric Key Import2 (CSNDSYI2) | Managing AES, DES and HMAC cryptographic keys |
| CSNBUKD | Unique Key Derive (CSNBUKD) | Managing AES, DES and HMAC cryptographic keys |
| CSNBDEC | Decipher (CSNBDEC) | Protecting data |
| CSNBENC | Encipher (CSNBENC) | Protecting data |
| CSNBSAD | Symmetric Algorithm Decipher (CSNBSAD) | Protecting data |
| CSNBSAE | Symmetric Algorithm Encipher (CSNBSAE) | Protecting data |
| CSNBCTT2 | Cipher Text Translate2 (CSNBCTT2) | Protecting data |
| CSNBHMG | HMAC Generate (CSNBHMG) | Verifying data integrity and authenticating messages |
| CSNBHMV | HMAC Verify (CSNBHMV) | Verifying data integrity and authenticating messages |
| CSNBMGN | MAC Generate (CSNBMGN) | Verifying data integrity and authenticating messages |
| CSNBMGN2 | MAC Generate2 (CSNBMGN2) | Verifying data integrity and authenticating messages |
| CSNBMVR | MAC Verify (CSNBMVR) | Verifying data integrity and authenticating messages |
| CSNBMVR2 | MAC Verify2 (CSNBMVR2) | Verifying data integrity and authenticating messages |
| CSNBOWH | One-Way Hash (CSNBOWH) | Verifying data integrity and authenticating messages |
| CSNBAKRL | AES Key Record List (CSNBAKRL) | Key storage mechanisms |
| CSNBKRL | DES Key Record List (CSNBKRL) | Key storage mechanisms |
| CSNDKRL | PKA Key Record List (CSNDKRL) | Key storage mechanisms |
| CSNBAPG | Authentication Parameter Generate (CSNBAPG) | Financial services |
| CSNBCPE | Clear PIN Encrypt (CSNBCPE) | Financial services |
| CSNBPGN | Clear PIN Generate (CSNBPGN) | Financial services |
| CSNBCPA | Clear PIN Generate Alternate (CSNBCPA) | Financial services |
| CSNBCSG | CVV Generate (CSNBCSG) | Financial services |
| CSNBCSV | CVV Verify (CSNBCSV) | Financial services |
| CSNBEPG | Encrypted PIN Generate (CSNBEPG) | Financial services |
| CSNBPTR | Encrypted PIN Translate (CSNBPTR) | Financial services |
| CSNBPTR2 | Encrypted PIN Translate2 (CSNBPTR2) | Financial services |
| CSNBPTRE | Encrypted PIN Translate Enhanced (CSNBPTRE) | Financial services |
| CSNBPVR | Encrypted PIN Verify (CSNBPVR) | Financial services |
| CSNBPVR2 | Encrypted PIN Verify2 (CSNBPVR2) | Financial services |
| CSNBPCU | PIN Change/Unblock (CSNBPCU) | Financial services |
| CSNBFPED | FPE Decipher (CSNBFPED) | Financial services |
| CSNBFPEE | FPE Encipher (CSNBFPEE) | Financial services |
| CSNBFPET | FPE Translate (CSNBFPET) | Financial services |
| CSNBFFXD | Format Preserving Algorithms Decipher (CSNBFFXD) | Financial services |
| CSNBFFXE | Format Preserving Algorithms Encipher (CSNBFFXE) | Financial services |
| CSNBFFXT | Format Preserving Algorithms Translate (CSNBFFXT) | Financial services |
| CSNBPFO | Recover PIN from Offset (CSNBPFO) | Financial services |
| CSNBSKY | Secure Messaging for Keys (CSNBSKY) | Financial services |
| CSNBSPN | Secure Messaging for PINs (CSNBSPN) | Financial services |
| CSNBTRV | Transaction Validation (CSNBTRV) | Financial services |
| CSNBDMP | DK Migrate PIN (CSNBDMP) | Financial services for DK PIN methods |
| CSNBDPMT | DK PAN Modify in Transaction (CSNBDPMT) | Financial services for DK PIN methods |
| CSNBDPC | DK PIN Change (CSNBDPC) | Financial services for DK PIN methods |
| CSNBDPV | DK PIN Verify (CSNBDPV) | Financial services for DK PIN methods |
| CSNDT34D | TR-34 Key Distribution (CSNDT34D) | TR-34 symmetric key management |
| CSNDT34R | TR-34 Key Receive (CSNDT34R) | TR-34 symmetric key management |
| CSNBT31X | TR31 Translate (CSNBT31X): renamed from Key Export to TR31 to: TR31 Translate | TR-31 symmetric key management |
| CSNBT31I | TR31 Key Import (CSNBT31I) | TR-31 symmetric key management |
| CSNBT31P | TR31 Key Token Parse (CSNBT31P) | TR-31 symmetric key management |
| CSNBT31O | TR31 Optional Data Build (CSNBT31O) | TR-31 symmetric key management |
| CSNDDSG | Digital Signature Generate (CSNDDSG) | Using digital signatures |
| CSNDDSV | Digital Signature Verify (CSNDDSV) | Using digital signatures |
| CSNDPKG | PKA Key Generate (CSNDPKG) | Managing PKA cryptographic keys |
| CSNDPKI | PKA Key Import (CSNDPKI) | Managing PKA cryptographic keys |
| CSNDPKT | PKA Key Translate (CSNDPKT) | Managing PKA cryptographic keys |