Edition September 2025, CCA Support Program Releases 8.4 and 7.6

Edit online

This edition describes the IBM® CCA Basic Services API for Releases 8.4 and 7.6.

CCA Releases 8.4 and 7.6 offer the following new features and functions:

  • Support for RSA keys in the range 4097 bits - 8192 bits is added and affects the following verbs:
    CSNDPKB CSNDPKG CSNDPKI CSNDPKX CSNDKTC
    CSNDDSG CSNDDSV CSNDPKE CSNDPKD
  • There is enhanced support for verb CSNBT31X with Mode of Use B. This verb now allows the translation of CCA AES PINPROT tokens to TR-31 P0 tokens with mode of use E, D, and B.
Note: To use the new RSA key sizes up to 8K, introduced with CCA Release 7.6, a host library from CCA Release 8.4 is required. Without the Release 8.4 host library, the features of Release 7.6 are not available.

The following verbs provide new or updated keywords or other updated information:

Table 1. Updated verbs for CCA Releases 8.4 and 7.6

Updated verbs for CCA Releases 8.4 and 7.6 with entry-point name, category, and long name with link to the verb description.
Verb Service name Release Category
CSNBKTB2 Key Token Build2 8.3, 8.4, 7.6 Managing AES, DES, and HMAC cryptographic keys
CSNDEDH EC Diffie-Hellman 8.3, 8.4, 7.6 Managing AES, DES, and HMAC cryptographic keys
CSNDPKD PKA Decrypt 8.3, 8.4, 7.6 Managing AES, DES, and HMAC cryptographic keys
CSNDPKE PKA Encrypt 8.3, 8.4, 7.6 Managing AES, DES, and HMAC cryptographic keys
CSNDPKB PKA Key Token Build 8.3, 8.4, 7.6 Managing PKA cryptographic keys
CSNBKTC PKA Key Token Change 8.3, 8.4, 7.6 Managing PKA cryptographic keys
CSNDPKG PKA Key Generate 8.3, 8.4, 7.6 Managing PKA cryptographic keys
CSNDPKI PKA Key Import 8.3, 8.4, 7.6 Managing PKA cryptographic keys
CSNDPKT PKA Key Translate 8.3, 8.4, 7.6 Managing PKA cryptographic keys
CSNDPKX PKA Public Key Extract 8.3, 8.4, 7.6 Managing PKA cryptographic keys
CSNDDSG Digital Signature Generate 8.3, 8.4, 7.6 Using digital signatures
CSNDDSV Digital Signature Verify 8.3, 8.4, 7.6 Using digital signatures
CSNBT31X TR31 Translate 8.3, 8.4, 7.6 TR-31 symmetric key management
Table 2. New and updated ACPs for CCA Releases 8.4 and 7.6

New and updated ACPs for CCA Releases 84 and 7.6 with ACP offset, command name and default setting.
ACP Definition Default
X'050A' T31X – Permit AES PINPROT to P0:B 1

CCA Release 8.4 additionally offers the following new features and functions:

  • Multiple enhancements for post-quantum computing (PQC) are provided.
    Support for ML-KEM (X'06'), pure ML-DSA (X'05'), and pre-hash ML-DSA (X'07') is added. The affected verbs are included in Table 1.
    Note on terminology: Pure ML-DSA (algorithm identifier X'05') and pre-hash ML-DSA (algorithm identifier X'07') are distinct key types. To simplify documentation, the term ML-DSA is used to denote both types where appropriate.
Important: Starting with version 8.4, the CCA host library is shared across IBM Z® and non-Z environments. Read the information provided in Compatibility considerations.