PKA Key Token Build (CSNDPKB and CSNFPKB)

z/OS Cryptographic Services ICSF Application Programmer's Guide

PKA Key Token Build (CSNDPKB and CSNFPKB)

z/OS Cryptographic Services ICSF Application Programmer's Guide
SA22-7522-16

Use this callable service to build external PKA key tokens containing unenciphered private RSA, DSS, or ECC keys, or public RSA, DSS, or ECC keys. This callable service is used to create the following:

A skeleton_key_token for use with the PKA Key Generate callable service (see Table 227)
A key token with a public key that has been obtained from another source
A key token with a clear private-key and the associated public key
A key token for an RSA private key in optimized Chinese Remainder Theorem (CRT) form.
An RSA token with X'09' section identifier using the RSAMEVAR keyword to obtain a token for a key in modulus-exponent form that is variable length.

DSS key generation requires this information in the input skeleton token:

Size of modulus p in bits
Prime modulus p
Prime divisor q
Public generator g
Optionally, the private key name

Note:

DSS standards define restrictions on the prime modulus p, prime divisor q, and public generator g. (Refer to the Federal Information Processing Standard (FIPS) Publication 186 for DSS standards.) This callable service does not verify all of these restrictions. If you do not follow the restrictions, the keys you generate may not be valid DSS keys.

Restriction: DSS is not supported on a PCIXCC, CEX2C, or CEX3C. PKA key token build will still build DSS tokens, but they cannot be used in any other service on the z890, z990, z9 EC, z9 BC, z10 EC and z10 BC.

ECC key generation requires this information in the skeleton token:

The key type: ECC
The type of curve: Prime or Brainpool
The size of P in bits: 192, 224, 256, 384 or 521 for Prime curves and 160, 192, 224, 256, 320, 384, or 521 for Brainpool curves
Key usage information
Optionally, application associated data

The callable service name for AMODE(64) invocation is CSNFPKB.

Notices | Terms of use | Support | Contact z/OS | zFavorites