Cryptographic configuration

Edit online

The opportunity to clear or zeroize the cryptographic keys associated with a usage domain is available when removing a crypto using the Change LPAR Cryptographic Controls task. The zeroize of the cryptographic keys can also be performed using the Cryptographic Configuration task.

Figure 1. Cryptographic configuration window
cryptographic configuration window
The Cryptographic Configuration task can be used to configure and monitor the cryptos that are installed on your system. Use this window to perform various tasks, including:
  • Checking the status and details of the Crypto Express feature
  • Testing the Random Number (RN) generator of the CCA Coprocessor
  • Manually zeroizing cryptos and erasing configuration data from the Support Element
  • If you select one or more cryptographic devices and click Domain Management, a window displays to select the specific usage domains to clear the master keys. If you click Zeroize, the master keys will be cleared for all domains on the selected cards. If you click Zeroize All the master keys are cleared for all devices that are configured or online for the CPC.
    Note: The Zeroize and Zeroize All reset the TKE commands flag to Not Supported. If you want to continue to manage a crypto adapter using TKE, you will need to click TKE Commands.
  • Run Customer Initiated Selftest of the EP11 Coprocessor.
  • Manually clear the cryptographic keys within the given usage domain(s).
  • Import and activate a UDX file configuration.
  • Indicate whether to permit TKE commands for processing on the selected CCA Coprocessor.
  • Indicate the crypto type configuration for the Crypto Express feature.
Note: With Crypto Express, Segment 3 of the Common Cryptographic Architecture (CCA) supports Concurrent Driver Upgrade (CDU). In other words, Segment 3 of the CCA can be updated dynamically, and therefore does not require a configure on/off to activate these changes. (However, there may be cases where an update of Segment 3 CCA may be disruptive, these will be identified in the documentation for the MCL). If Segment 1 or 2 is updated, the crypto must be restarted (for example, Configure Off/On) in order to utilize the firmware updates.