Generating PCI-HSM 2016 compliant keys

Edit online

A cryptographic coprocessor running in PCI-HSM 2016 compliance mode can use compliant-tagged key tokens. Read the contained information about how to generate PCI-HSM 2016 compliant keys.

A compliant-tagged key token is a key token that must adhere to the requirements of a compliance mode. For CCA tokens, the compliant tag is indicated by bit 58 in the control vector of the key token. For more information about the compliant tag, see the description of the COMP-TAG keyword in Managing control vectors.

For TR-31 tokens, the compliant tag is specified in the IBM® proprietary optional block, which has a block ID X'3130' (ASCII '10') and TLV X'3032' (ASCII '02'). The compliance tag flag is set in the first byte of data (bit 5) and the following three bytes are used as the KDF indicator (the last of these bytes are set to 0x04 to indicate that there is a compliance tag for TR-31). See Table 1 and Table 2 for more information on the IBM optional block.

In turn, a compliance mode places certain restrictions on the use of compliant-tagged key tokens, as described in Restrictions on creation and use of PCI-HSM 2016 compliant key tokens.

For CCA tokens, to generate a compliant-tagged key token, you must at first build a skeleton token with the compliant tag (bit 58) switched on. The Control Vector Generate (CSNBCVG) and Key Token Build (CSNBKTB) services allow that. This skeleton token can then be passed to any callable service that generates key tokens and supports compliant-tagged key tokens, for example, Key Generate (CSNBKGN).

The EMV services are exceptions as they do not support skeleton tokens as input. When importing a TR-31 key block, if the key encrypting key is compliant-tagged, the resulting key is also compliant-tagged.

Note: Only internal, fixed-length TDES key tokens can be compliant-tagged.

CSNBT31C compliance tag

To build a compliance-tagged key token with the CSNBT31C service, the COMP-TAG keyword must be specified in the rule array and you must be building an internal key token. TR-31 tokens can not be compliance-tagged if they have exportability S. Additionally, you must be in active compliance mode. The returned key token contains the IBM optional block with the compliance tag bit set and the KDF indicator. The token must also follow other compliance tag rules (for example, no single length DES). This token can then be used in services that require a compliance-tagged token or is sent into CSNBT31X or CSNBT31I to translate it.

CSNBT31X compliance tag

In CSNBT31X, there are a few ways to build and check the compliance of a key token. Two new keywords are available in the Wrapping Method rule array group:

  • COMP-CHK: Checks to see if the key token can be compliance-tagged. This input token can be internal or external. If the input key token already has a compliance tag, return code/reason code 8/2418 is returned. If it can be compliance-tagged, 0/0 is returned. This does not change the token in any way, but this keyword must be specified without any other keywords.
  • COMP-TAG: Changes the key token to a compliance-tagged key token. The input token must be an internal token. The token is re-wrapped using the compliance tag method and returned with the KDF bytes and compliance tag bit set in the IBM optional block (which is added if it was not already present). The other attributes of the key (usage, mode, context, KFL, etc.) stay the same. This keyword must be specified without any other keywords and you must be in migration mode to use this.

Additionally, CSNBT31X can change compliance-tagged tokens that are sent in when in active compliance mode. You can translate an input compliance-tagged token in the following ways:

Table 1. Translating input compliance-tagged tokens

Translating input compliance-tagged tokens
Rule array keyword source_key_identifier unwrap_key_identifier wrap_key_identifier t31_key_block
STOREXCH or EXCHANGE Internal TR-31 compliance-tagged token N/A Compliance-tagged KEK External TR-31 token wrapped by compliance-tagged KEK
INTERNAL External TR-31 token Compliance-tagged KEK N/A Internal TR-31 compliance-tagged token

CSNBT31I compliance tag

T31I accepts a compliance-tagged TR-31 token as input and returns a compliance tagged CCA token, if allowed. You must be in active compliance mode when sending in any compliance-tagged tokens to T31I. You can translate an input comp-tagged token in the following ways:

Table 2. Translating input compliance-tagged tokens for CSNBT31I

You can translate an input comp-tagged token in the following ways. Table with five columns showing Rule array keyword, source key identifier, unwrap key identifier, wrap key identifier, and TR-31 key block
Rule array keyword TR-31 key block Unwrap key identifier Wrap key identifier Output key identifier
INTERNAL Internal TR-31 compliance-tagged token N/A N/A Internal CCA compliance-tagged token
EXTERNAL Internal TR-31 compliance-tagged token N/A Compliance-tagged KEK External CCA token wrapped by compliance-tagged KEK
INTERNAL External TR-31 token Compliance-tagged KEK N/A Internal CCA compliance-tagged token
EXTERNAL External TR-31 token Compliance-tagged KEK Compliance-tagged KEK External CCA token wrapped by compliance-tagged KEK