Required commands
The required commands for CSNDSYI2.
The Symmetric Key Import2 verb requires the following commands to be enabled in the active role:
| Key-formatting method keyword | Token algorithm keyword | Offset | Command |
|---|---|---|---|
| AESKW (Rel. 4.2 or later) | AES or HMAC | X'0329' | Symmetric Key Import2 - AESKW |
| AESKWCV (Release 4.4 or later) | DES | X'02B4' | Symmetric Key Import2 - AESKWCV |
| WRAP-ECB or WRAP-ENH, when the default key-wrapping method setting does not match the keyword | DES | X'02B9' | Symmetric Key Import2 - Allow wrapping override keywords |
| PKOAEP2 | AES (Rel. 4.2 or later) | X'00FD' | Symmetric Key Import2 - AES,PKOAEP2 |
| PKOAEP2 | HMAC | X'00F4' | Symmetric Key Import2 - HMAC,PKOAEP2 |
| CKM_RAKW | AES | X'03CD' | Permit import of an AES key token from a PKCS#11 CKM_RSA_AES_KEY_WRAP object |
To disallow the import of a key wrapped with a weaker transport key, the Symmetric Key Import2 - disallow weak import command (offset X'032B') must be enabled in the active role. This command affects multiple verbs. See Access control points and verbs.
To receive a warning against the wrapping of a stronger key with a weaker key, the Warn when weak wrap - Transport keys command (offset X'032C') must be enabled in the active role. The Symmetric Key Import2 - disallow weak import command overrides this command.
To disable the wrapping of a key with a weaker master key, the Prohibit weak wrapping - Master keys command (offset X'0333') must be enabled in the active role.
To receive a warning when wrapping a key with a weaker master key, enable the Warn when weak wrap - Master keys command (offset X'0332') in the active role. The Prohibit weak wrapping - Master keys command overrides this command.