Restrictions on creation and use of PCI-HSM 2016 compliant key tokens

Edit online

Read about the restrictions that apply to PCI-HSM 2016 compliant key tokens.

In addition to the callable services above, certain restrictions are placed on compliant-tagged key tokens regardless of the service.

  • DES
    • Only internal DES key tokens may be compliant-tagged.
    • Only the enhanced wrapping method can be used.
    • Single-length key tokens cannot be compliant-tagged.
    • Key encrypting keys (KEKs, including master keys) must be at least as strong as the keys they protect. Therefore, a KEK with replicated key halves can not wrap a key with unique key halves.
    • Default DATA key tokens (including zero CV DATA key tokens) cannot be compliant-tagged. They are multi-use keys capable of performing encipherment and creating MACs. One alternative is to upgrade to CIPHER or MAC keys, or both CIPHER and MAC keys. Currently, triple-length DATA keys with unique key parts have no migration path to becoming compliant-tagged without downgrading the key to a double-length key.
    • NOCV-KEKs cannot be compliant-tagged.
    • Compliant-tagged key tokens are restricted in terms of the verification patterns that can be calculated. Only the ENC-ZERO and CMACZERO verification patterns are allowed. See the Key Test (CSNBKYT), Key Test Extended (CSNBKYTX), and Key Test2 (CSNBKYT2) callable services for more detail. In addition, for the Key Test and Key Test Extended services, the KEY-ENCD keyword is required.
    • Generally, compliant-tagged key tokens cannot be used with non-compliant-tagged key tokens. The exceptions are:
      • The Cipher Text Translate2 (CSNBCTT2) callable service.
      • Compliant-tagged key tokens may be used with an X.509 certificate which is compliant.
    • Compliant-tagged key tokens are restricted from performing certain PIN block translation operations. For more information, see Table 1.
    • Compliant-tagged keys cannot be used with the following RSA-encrypted key formats: PKCSAOEP, PKCS-1.2, ZEROPAD.

    Compliant-tagged key tokens are defined by two features of the key token:

    1. The compliant-tag bit in the key attributes, which is the CV for DES fixed-length key tokens.
    2. The key derivation function (KDF) value which indicates what generation of compliance is applicable.

    The KDF value appears at the end of the truncated Master Key Verification Pattern (MKVP) section. For additional information, see Key token formats.

    Key tokens with the compliant-tag bit on in the control vector and a key derivation function (KDF) of less than X'03' are no longer considered compliant-tagged. They are referred to as DES KDF 01 or 02 tokens throughout the ICSF and CCA publications. They were either created on a Crypto Express adapter which does not have the May 2021 (CCA 7.3 or CCA 6.6) or later licensed internal code or by theDiversified Key Generate (CSNBDKG) or Unique Key Derive (CSNBUKD) services using an input DES KDF 01 or 02 token. A DES KDF 01 key token can only be used with other DES KDF 01 tokens. Beginning with the May 2021 or later licensed internal code (LIC), a DES KDF 02 token can only be used with other DES KDF 02 key tokens. The only exception to this is a DES KDF 01 or 02 key token can also be used with an X.509 certificate or with any other key token in the Cipher Text Translate2 (CSNBCTT2) callable service. It is recommended that DES KDF 01 and 02 tokens be migrated using the Key Translate2 (CSNBKTR2) service with the COMP-TAG keyword. The output is a key token with the compliant-tag bit set in the control vector and a KDF of X'03' or greater. Only DES tokens with a KDF of X'03' or greater are referred to as compliant-tagged key tokens. Key tokens without the compliant-tag bit set or DES KDF 01 or 02 tokens are referred to as non-compliant-tagged tokens and this is reflected in ICSF output (CCA displays as well as log records do not show DES KDF 01 or 02 tokens as compliant-tagged). Though DES KDF 01 or 02 tokens are not compliant-tagged, a coprocessor in compliance mode is required to use them.

  • AES
    • Only internal version 05 AES key tokens may become compliant-tagged (AES version 04 DATA key tokens may be migrated to version 05 using the Key Translate2 (CSNBKTR2) callable service).
    • Key encrypting keys (KEKs, including master keys) must be at least as strong as the keys they protect.
    • Compliant-tagged key tokens are restricted in terms of the verification patterns that can be calculated. Only the CMACZERO verification pattern is allowed.
    • Compliant-tagged keys may not have a variable-length payload (V0PYLD). Only fixed-length payloads are allowed (V1PYLD).
    • Generally, compliant-tagged key tokens cannot be used with non-compliant-tagged key tokens. The exceptions are:
      • The Cipher Text Translate2 (CSNBCTT2) callable service.
      • Compliant-tagged key tokens may be used with an X.509 certificate which is compliant.
    • Compliant-tagged key tokens are restricted from performing certain PIN block translation operations. For more information, see Table 606 on page 1508.
    • Compliant-tagged keys cannot be used with the following RSA-encrypted key formats: PKCSAOEP, PKCS-1.2, ZEROPAD.
  • RSA
    • Only internal RSA key tokens with private key sections X'30' or X'31' and associated data versions X'04' or X'05' may become compliant-tagged. This corresponds to keywords RSAAESM2 and RSAAESC2 on the PKA Key Token Build (CSNDPKB) callable service. Other private key sections may be migrated using the PKA Key Translate (CSNDPKT) callable service.
    • Compliant-tagged key tokens must be single usage, or in other words, may not perform both signatures and key encipherment. See PKA Key Token Build (CSNDPKB) for details.
    • Compliant-tagged keys must have a minimum modulus size of 2048 bits.
    • Key encrypting keys (KEKs, including master keys) must be at least as strong as the keys they protect.
    • Compliant-tagged key tokens cannot be used with non-compliant-tagged key tokens. However, compliant-tagged key tokens may be used with an X.509 certificate which is compliant.
    • An RSA public key token may not be used to wrap a compliant-tagged symmetric key token.
    • Compliant-tagged keys cannot be used with the following RSA-encrypted key formats: PKCSAOEP, PKCS-1.2, ZEROPAD.
    • Compliant-tagged keys cannot use the SHA-1 hash method.

X.509 certificates (RSA)

An X.509 certificate cannot be compliant-tagged. However, it may be used with compliant-tagged tokens if the X.509 certificate is considered compliant and PKI validation is active for the request. PKI validation is active if the request specifies or defaults to the PKI-CHK keyword. A certificate is considered compliant if it satisfies all of the following:

  1. It is single usage (any combination of the following signature usages may be allowed by the certificate and it is still considered single usage: digitalSignature, nonRepudiation, keyCertSign, cRLSign).
  2. It has a minimum modulus size of 2048 bits.
  3. The signature algorithm does not specify the SHA-1 hashing method.

One way to create a certificate with specific key usage attributes is to use the Public Infrastructure Certificate (CSNDPIC) callable service to create a certificate signing request (CSR) with the desired key usage attributes. This CSR can then be signed by a Certificate Authority (CA) to create a certificate with the desired key usage attributes.

When used with a compliant-tagged key token, certificates must fulfill the following conditions:

  • They must be at least as strong as the keys they protect.
  • They cannot use the following RSA-encrypted key formats: PKCSAOEP, PKCS-1.2, ZEROPAD.
  • They cannot use the SHA-1 hash method.