Required commands

The TR31 Translate verb requires the following commands to be enabled in the active role:

Be aware of the interaction of access-control point X'0158' (T31X - Permit any CCA key if INCL-CV is specified) with the INCL-CV keyword. Without the INCL-CV keyword, most export translations are guarded by key-type-specific access control points, to guard the source CCA system against attacks involving re-import of the exported key under ambiguous circumstances. When the control vector is exported along with the key as an optional block securely bound to the encrypted key, the source system is somewhat protected because the key on import is allowed to have only the form of the included control vector. No expansion of capability is allowed. If access-control point X'0158' is enabled in the active role, the key-type-specific access control points are not checked when INCL-CV is provided. If ACP X'0158' is not enabled, the type-specific access control points are still required. Figure 1 illustrates this concept:

Be aware of access control point X'01B0' (T31X - Permit DES PINGEN to V0:N and DES PINVER to V1/V2:N) for export of PINGEN or PINVER keys to TR-31 key blocks, key usage V0, V1, or V2, and mode N. TR-31 key blocks may use the same mode N for PINGEN as well as PINVER keys. Enabling a PINGEN and PINVER access-control point while enabling offset X'01B0' (for keyword ANY, mode N) is NOT recommended. Failure to comply with this recommendation allows changing PINVER keys into PINGEN and the other way around.