Generating warning events

Edit online

You use the CSU_CMP_WARN_MODE environment variable to cause CCA to issue warning events for operations that need modifications to meet PCI-HSM 2016 compliance mode requirements. Warning events are created as entries to SYSLOG in a certain layout, specifying information about the required actions.

Setting the CSU_CMP_WARN_MODE environment variable

If set, the CSU_CMP_WARN_MODE environment variable indicates that you want to have PCI-HSM 2016 compliance mode warnings generated. The values can be one of the following:

OFF
This is the default value for the variable. No warning mode is set and no warning events are created.
SYSLOG
The warning mode output is sent in a log content stream to the system log and creates an entry in the SYSLOG file as described in Warning log message layout.
Note:
  • No log entry is written when an operation is completely compliant (compliant verb and compliant keys).
  • Warning mode responses are sent to the configured system log.

Warning log message layout

The overall syntax of a generated warning message looks like shown:


<preamble>CSUCMPW:<serialnum>:<KDF>:<cprbflags>:<verb_code>:<keyword_count>:
                  <keywords>:<key_count>

The name of the application which causes the triggering of the warning is not displayed in the message, but is captured by the system log itself. The components have the following meanings:

preamble
Content that a SYSLOG entry typically puts at the start of each message. If the SYSLOG is not the output target, then no preamble is posted.

A part of the preamble posted by the SYSLOG is the ASCII name of the application that was processing when the warning triggered. See the following example for details.

CSUCMPW
ASCII eye-catcher to mark the start of each entry
serialnum
ASCII representation of adapter serial number that generated the reply containing the warning response.
KDF
Key Derivation Function (KDF) value used in the host-to-card communication buffer. It corresponds to the compliance level of the crypto card. This field is one binary byte. It is printed as two hexadecimal characters in ASCII.
cprbflags
Warning flag value returned from the adapter for the verb. This field is one binary byte. It is printed as two hexadecimal characters in ASCII.
Flag value
Meaning
0x40
CPRBFO_CMP_BAD_VERB: The requested verb is not compliant with the current target.
0x20
CPRBFO_CMP_BAD_OP: The requested verb (keyword or data) is not compliant with the current target
0x10
CPRBFO_CMP_BAD_KEY: The request included one or more keys that are not compliant with the current target
0x08
CPRBFO_CMP_UNK: The request for the warning mode processing could not be honored due to problems with the input. The main reason is an unknown value supplied by the host library to the adapter as the target KDF: This is an internal error.
0x00
No consideration of compliance was made.
verb_code
Name of the verb encoded as two ASCII characters. See column Subcommand code in Table 1 for the encoding reference.
keyword_count
ASCII number for the count of verb keywords contained in the request.
keywords
Keywords that were in request when sent to the adapter. Some API calls are split up into smaller requests when sent to the adapter to overcome bus transfer size limitations. Therefore, keywords may be slightly different when sent to the adapter. Also, a single API request may generate more than one warning log entry.

If the keyword_count is 0x00, this field is empty, such that only the delimiters on either side are visible (::).

key_count
Count of keys that were sent to the adapter.

Below is a warning message from the CSNBCTT2 verb, using a double length DES DATA token which can not be COMP-TAGGED in compliance mode.


Jan 12 09:51:01 test05 s6ctt2.e[24516]: IBM Crypto ./f_secy2/sefcmpwarn.c:627, 
Nov  8 2017:15:02:05: 
CSUCMPW:DV753302:01:10:TT:5:IKEY-DESOKEY-DESI-CBC   O-CBC   INITIAL :2
CSUCMPW
is the eye-catcher you should search for. All material previous to this ASCII string is the so-called preamble. As a part of this preamble, the SYSLOG captures the name of the application executing when warning triggered. In our example, this is s6ctt2.e (running on the test05 system.
DV753302
is the serial number of the adapter that generated the warning.
01
is the compliance level in the card (KDF parameter).
10
specifies that the request included one or more keys that are not compliant with the current target (cprbflags0 parameter).
TT
is the verb code for CSNBCTT2 as provided in Table 1 (verb-code parameter). TT stands for CSNBCTT2.
5
is the number of 8 byte keywords (keywordcount parameter).
IKEY-DESOKEY-DESI-CBC O-CBC INITIAL
are the five 8 byte keywords provided by the keywords parameter:
  • IKEY-DES
  • OKEY-DES
  • I-CBC
  • O-CBC
  • INITIAL

This part can be empty (::) if no keywords are supplied in the request.

Note that sometimes requests are split into smaller requests when sent to the adapter.

2
is the number of keys supplied to CSNBCTT2 (key_count parameter).

Another example shows how to use the CSNBKYT verb to obtain SHA-1 hashes of master keys in legacy mode. The warning mode is logging that the requested verb service (keyword or data) is not compliant with current target:


Jan 12 09:49:04 test05 load.e[24427]: IBM Crypto ./f_secy2/sefcmpwarn.c:627, 
Nov  8 2017:15:02:05: CSUCMPW:DV753302:01:20:KT:3:GENERATEKEY-KM  SYM-MK  :1
Jan 12 09:49:04 test05 load.e[24427]: IBM Crypto ./f_secy2/sefcmpwarn.c:627, 
Nov  8 2017:15:02:05: CSUCMPW:DV753302:01:20:KT:3:GENERATEKEY-OKM SYM-MK  :1
Jan 12 09:49:04 test05 load.e[24427]: IBM Crypto ./f_secy2/sefcmpwarn.c:627, 
Nov  8 2017:15:02:05: CSUCMPW:DV753302:01:20:KT:3:GENERATEKEY-KM  APKA-MK :1
Jan 12 09:49:04 test05 load.e[24427]: IBM Crypto ./f_secy2/sefcmpwarn.c:627, 
Nov  8 2017:15:02:05: CSUCMPW:DV753302:01:20:KT:3:GENERATEKEY-OKM APKA-MK :1