Required commands

Edit online

The required commands for CSNDRKX.

This verb requires the Remote Key Export - Gen or export a non-CCA node key command (offset X'0312') to be enabled in the active role.

The verb also requires the Key Generate - SINGLE-R command (offset X'00DB') to be enabled to replicate a single-length source key (either from a CCA DES key-token or an RKX key-token). If authorized, key replication occurs if all of the following are true:

  1. The key token returned using the sym_encrypted_key_identifier parameter is a CCA DES key-token, as defined in the rule section identified by the rule_id parameter.
  2. The rule section identified by the rule_id parameter has a common export key parameters subsection defined, and the control vector in the subsection is 16 bytes in length with key-form bits of B'010' for the left half and B'001' for the right half.
  3. The token identified by the source_key_identifier parameter is single length, and is either a CCA DES key-token or an RKX key-token.
Note: A role with X'00DB' enabled can also use the Key Generate verb with the SINGLE-R key-length keyword.

To enable the use of key-encrypting-keys with the NOCV option for export, this verb requires the NOCV KEK usage for export-related functions command (offset X'0300') to be enabled in the active role.

To enable the use of key-encrypting-keys with the NOCV option for import, this verb requires the NOCV KEK usage for import-related functions command (offset X'030A') to be enabled in the active role.

This verb also requires the following commands to be enabled in the active role:

Required commands for the CSNDRKX verb
Rule-array keyword Offset Command


USECONFG
WRAP-ECB
WRAP-ENH
ENH-ONLY

 X'013F' Remote Key Export - include RKX in default wrap config
WRAP-ECB or WRAP-ENH and default key-wrapping method setting does not match keyword X'02BA' Remote Key Export - Allow wrapping override keywords

Commands related to wrapping DES keys coincide with the addition of rule array keywords to specify key-wrapping method and translation control:

  • Remote Key Export - include RKX in default wrap config (offset X'013F')

    Enable this command in the active role to allow any rule array keywords to be specified or, in the absence of a key-wrapping method keyword, to have the verb wrap the DES key using the default key-wrapping configuration (USECONFG) setting. Enabling X'013F' makes the verb behave in the same manner as other verbs that accept key-wrapping method and translation control keywords.

    Note: The purpose of offset X'013F' is to provide a way to maintain backward compatibility with the key-wrapping method used in releases before Release 4.4. To maintain backward compatibility with releases that do not accept key-wrapping method keywords, do not enable X'013F' in the active role.
  • Remote Key Export - Allow wrapping override keywords (offset X'02BA')

    This command requires offset X'013F' to be enabled in the active role. Enable offset X'02BA' in the active role to allow a key-wrapping keyword to be specified that overrides the default key-wrapping configuration.

When an existing key is exported into a CCA fixed-length DES key-token (that is, offset 18 in the selected trusted block rule section is X'01') and the Remote Key Export - include RKX in default wrap config command (offset X'013F') is not enabled in the active role (or the release is before Release 4.4), the DES key identified by the sym_encrypted_key_identifier parameter is wrapped based on the following criteria depending on whether the source key is an RKX key-token or a CCA fixed-length DES key-token:

  • Source key is an RKX key-token:

    Table with three columns describing if Source key is an RKX key-token
    Configuration setting of default wrapping method CV bit 56 of rule subsection X'0003' of selected trusted block rule section Wrapping method (and CV bit 56) of exported DES key
    WRAP-ECB (legacy) No CV (CV length = 0) WRAP-ECB (B'0')
    B'0' (not ENH-ONLY) WRAP-ECB (B'0')
    B'1' (ENH-ONLY) Error
    WRAP-ENH (enhanced) No CV WRAP-ENH (B'0')
    B'0' WRAP-ENH (B'0')
    B'1' WRAP-ENH (B'1')
  • Source key is a CCA fixed-length DES key-token:

    Table with four columns describing if Source key is a CCA fixed-length DES key-token
    Source key wrapping method CV bit 56 of source key CV bit 56 of rule subsection X'0003' of selected trusted block rule section Wrapping method (and CV bit 56) of exported DES key
    WRAP-ECB (legacy) B'0' (not ENH-ONLY) No CV (CV length = 0) WRAP-ECB (B'0')
    B'0' (not ENH-ONLY) WRAP-ECB (B'0')
    B'1' (ENH-ONLY) Error
    WRAP-ENH (enhanced) B'0' No CV WRAP-ENH (B'0')
    B'0' WRAP-ENH (B'0')
    B'1' WRAP-ENH (B'1')
    B'1' (ENH-ONLY) No CV WRAP-ENH (B'0')
    B'0' Error
    B'1' WRAP-ENH (B'1')