Key types and mechanisms supported

ICSF supports the following PKCS #11 key types (CK_KEY_TYPE). All of these key types are supported in software. Whether they are also supported in hardware will depend on the limitations of your cryptographic hardware configuration.

• CKK_AES - key lengths 128, 192, and 256 bits
• CKK_BLOWFISH - key lengths 8 up to 448 bits (in increments of 8 bits)
• CKK_DES
• CKK_DES2
• CKK_DES3
• CKK_DH - key lengths 512 up to 2048 bits (in increments of 64 bits)
• CKK_DSA - key lengths 512 up to 2048 bit prime lengths (in increments of 64 bits)
• CKK_EC (CKK_ECDSA) - key lengths 160 up to 521 bits
• CKK_GENERIC_SECRET - key lengths 8 up to 2048 bits, unless further restricted by the generation mechanism:
  • CKM_DH_PKCS_DERIVE - key lengths 512 up to 2048 bits
  • CKM_SSL3_MASTER_KEY_DERIVE - 384-bit key lengths
  • CKM_SSL3_MASTER_KEY_DERIVE_DH - 384-bit key lengths
  • CKM_SSL3_PRE_MASTER_KEY_GEN - 384-bit key lengths
  • CKM_TLS_MASTER_KEY_DERIVE - 384-bit key lengths
  • CKM_TLS_MASTER_KEY_DERIVE_DH - 384-bit key lengths
  • CKM_TLS_PRE_MASTER_KEY_GEN - 384-bit key lengths
• CKK_RC4 - key lengths 8 up to 2048 bits
• CKK_RSA - key lengths 512 up to 4096 bits

The following table shows the mechanisms supported by different hardware configurations. All the mechanisms are supported in software, and some may be available in hardware. If the mechanism is available in hardware, ICSF will use the hardware mechanism. If the mechanism is not available in hardware, ICSF will use the software mechanism. The following table also shows the flags returned by the C_GetMechanismInfo function in the CK_MECHANISM_INFO structure. Whether or not the CKF_HW flag is returned in the CK_MECHANISM_INFO structure indicates whether or not the mechanism is supported in the hardware.

Footnotes for Table 1

¹ The PKCS #11 standard designates two ways of implementing Elliptic Curve Cryptography, nicknamed F_p and F₂^m. z/OS PKCS #11 supports the F_p variety only.

      Parameters ::= CHOICE {
        ecParameters  ECParameters,
        namedCurve    OBJECT IDENTIFIER,
        implicitlyCA  NULL }

In addition, z/OS PKCS #11 has limited support for the ecParameters CHOICE. When specified, the DER encoding must contain the optional cofactor field and must not contain the optional Curve.seed field. Also, calls to C_GetAttributeValue to retrieve the CKA_EC_PARAMS attribute will always return the value in the namedCurve form regardless of how the attribute was specified when the object was created. Due to these limitations, the CKF_EC_ECPARAMETERS flag is not turned on for the applicable mechanisms.

³ Mechanism not present on a system that is export controlled.

⁴ Mechanism limited to 56-bit on a system that is export controlled.

⁶ RSA public or private keys that have a public exponent greater than 8 bytes in length can only be used when a coprocessor or accelerator is present.

⁷ Mechanism supported for clear keys only.

⁸ Mechanism supported for secure keys only.

typedef struct CK_RSA_PKCS_PSS_PARAMS {
CK_MECHANISM_TYPE hashAlg;
CK_RSA_PKCS_MGF_TYPE mgf;
CK_ULONG sLen;
} CK_RSA_PKCS_PSS_PARAMS;