IBMJCECCA

The IBMJCECCA provider extends Java™ Cryptography Extension (JCE) and Java Cryptography Architecture (JCA) seamlessly to add support for hardware cryptography by using IBM Common Cryptographic Architecture (CCA) interfaces on the z/OS® operating system.

The IBMJCECCA provider implements the existing JCE architecture, taking advantage of hardware cryptography to give Java programmers the significant security and performance advantages of hardware cryptography with minimal changes to existing Java applications. Because the complexities of hardware cryptography are handled within the normal JCE APIs, the advanced security and performance of hardware cryptographic devices are made easily available.

IBM CCA is a set of software elements that provide common application interfaces to secure, high-speed cryptographic services on various platforms by using hardware cryptographic devices. On z/OS, access to hardware cryptographic devices is controlled by the Integrated Cryptographic Service Facility (ICSF). This software package provides IBM CCA interfaces to hardware devices that are used by the IBMJCECCA provider. One or more of these hardware cryptography features must be installed to use the IBMJCECCA provider.

For more information about the cryptographic features that are supported by your hardware, refer to the IBM Z® machine's reference or technical guide and your service or support organization.

The IBMJCECCA provider supports the following items:

• Message Digest by using the MD2, MD5, SHA-1, SHA-256, SHA-384, and SHA-512 algorithms
• Signature and KeyFactory classes
• The symmetric algorithms AES, DES, triple DES (also known as DESede), HMAC (HMAC using secure keys is available with the HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384, and HMACSHA512 algorithms), and PBE
• The asymmetric algorithms RSA encryption and decryption with zero padding and PKCS 1 type 2 padding
• Digital signature creation and verification by using RSA, DSA, and ECDSA algorithms (note that DSA is only supported on IBM® eServer™ zSeries 800 (z800) and IBM eServer zSeries 900 (z900) hardware; ECDSA is only supported on Crypto Express 3 Coprocessor (CEX3C) and newer cryptographic coprocessor cards)
• True random number generation
• Key generation by using key factories
• Generation and management of keys and certificates by using the hwkeytool application
• Symmetric key wrapping and unwrapping by using hardware AES and Triple DES transport keys (also known as key encrypting keys)
• Symmetric key export and import by using Triple DES transport keys (also known as key encrypting keys) and the key exchange mechanism that is described in the ANSI TR-31 Key Block specification
• The quantum-safe algorithms CRYSTALS-Kyber and CRYSTALS-Dilithium

byte storeType = KeyHWAttributeValues.PKDS;
byte keyUsage = KeyHWAttributeValues.KEYMANAGEMENT;
keyAttribs = new RSAKeyHWAttributes(storeType, keyUsage);

WrapperKey wrappedKey = new WrapperKey((java.security.PrivateKey)SoftwareKey, keyAttribs);

okeyStore.setKeyEntry(alias, wrappedKey, istorePass, certs);