Usage Notes

SAF may be invoked to verify the caller is authorized to use this callable service, the key label, or internal secure key tokens that are stored in the CKDS or PKDS.

Use of the Visa-PVV PIN-calculation method will always output four digits rather than padding the output with binary zeros to the length of the PIN.

On CCF systems, to use an IPINENC key, you must install the NOCV-enablement keys in the CKDS.

Note:

PBVC is supported for compatibility with prior releases of OS/390 ICSF and existing ICSF applications. If PBVC is specified in the format control parameter of the PIN profile, the Clear PIN Generate Alternate service will not be routed to a PCI Cryptographic Coprocessor for processing. This means that only control vectors and extraction methods valid for the Cryptographic Coprocessor Feature may be used if PBVC formatting is desired. It is recommended that a format control of NONE be used for maximum flexibility.

Table 180. PIN Block Variant Constants (PBVCs)

PIN Format Name

PIN Block Variant Constant (PBVC)

ECI-2

X'00000000000093000000000000009300'

ECI-3

X'00000000000095000000000000009500'

ISO-0

X'00000000000088000000000000008800'

ISO-1

X'0000000000008B000000000000008B00'

VISA-2

X'0000000000008D000000000000008D00'

VISA-3

X'0000000000008E000000000000008E00'

VISA-4

X'00000000000090000000000000009000'

3621

X'00000000000084000000000000008400'

3624

X'00000000000082000000000000008200'

4704-EPP

X'00000000000087000000000000008700'

This table shows the access control points in the ICSF role that control the function of this service.

Table 181. Required access control points for Clear PIN Generate Alternate

Rule array keywords

Access control point

IBM-PINO

Clear PIN Generate Alternate - 3624 Offset

VISA-PVV

Clear PIN Generate Alternate - VISA PVV

If the ANSI X9.8 PIN - Use stored decimalization tables only access control point is enabled in the ICSF role, any decimalization table specified must match one of the active decimalization tables in the coprocessors.

This table lists the required cryptographic hardware for each server type and describes restrictions for this callable service.

Table 182. Clear PIN generate alternate required hardware

Server

Required cryptographic hardware

Restrictions

IBM

zSeries 900

Cryptographic Coprocessor Feature

If PBVC is specified for format control, the request will be routed to a Cryptographic Coprocessor Feature.

ICSF routes the request to a PCI Cryptographic Coprocessor if:

The PIN_encryption_key_identifier identifies a key which does not have the default PIN encrypting control vector (either IPINENC or OPINENC).
IBM-PINO PIN calculation method is specified.
Anything is specified other than the default in the PIN extraction method keyword for the given PIN block format in rule_array.

IBM

zSeries 990

IBM zSeries 890

PCI X Cryptographic Coprocessor

Crypto Express2 Coprocessor

Format control in the PIN profile parameter must specify NONE.

IBM System z9 EC

IBM System z9 BC

Crypto Express2 Coprocessor

Format control in the PIN profile parameter must specify NONE.