Restrictions

• The RSA public-key modulus size (key length) is limited by the function control vector (FCV) to accommodate potential government export and import regulations.
• Retained keys are not supported.
• The maximum public exponent is 17 bits for any key that has a modulus greater than 2048 bits.
• As of CCA 5.4 and CCA 6.2, this verb supports three-key TDES keys. As a key management service this includes triple-length TDES key encrypting keys (KEKs). For a list of supported triple-length TDES key types beginning with Release 5.4 and Release 6.2, see Table 1.
• The CKM-RAKW keyword is not supported in CCA releases before 7.4. CKM-RAKW expects PKOAEP2 with SHA-1 therefore the message bit length is limited as indicated in Table 1.
• TR-31 tokens can only be used with this verb starting with CCA 8.1.
• TR-31 tokens can only be used in the transport_key_identifier parameter, and only when the AESKW or AESKWCV Key-formatting method rule array keywords are in use.

The Hash Method keyword is optional, required, or not allowed, depending on the key-formatting method specified. For PKCSOAEP, this is an optional keyword of SHA-1 or SHA-256 (SHA-1 is the default). For PKOAEP2, this is a required keyword. Specify SHA-1, SHA-256, SHA-384, or SHA-512. The remaining key formatting methods do not use a hash method. For hash-formatting method PKOAEP2, the RSA key used must have a modulus bit length greater than or equal to the total PKOAEP2 message bit length, calculated as shown: