Key storage with Linux on IBM Z, in contrast to z/OS

Key storage for IBM® z/OS® and for Linux® on the IBM platforms other than IBM Z®, diverged in design at their very inception.

Background information about master key management
There are four types (or sets) of master keys (Symmetric DES, AES, Asymmetric RSA (PKA), and APKA).
Key storage on z/OS (RTNMK-focused)
Design point - Keys should be re-enciphered to a master key in the NMK register.
Key storage for traditional IBM systems other than IBM Z (RTCMK-focused: Linux, AIX, Windows)
Design point - Keys should be re-enciphered to a master key in the CMK register.
Changing the master key for two or more adapters that have the same master key, with shared CCA key storage
Because the verification pattern of the current master key (CMK) is stored in a header in key storage, changing the master key for a configuration of multiple adapters required extra care in prior releases.
Key storage file ownership
The last user to access the key storage file owns it, due to the internals of the key storage functions.
The Linux on IBM Z approach
Because the CCA key storage design point for the Linux platform host release has always been CMK-focused, this design point was taken forward for the Linux on IBM Z approach.

Parent topic: Key storage mechanisms