Table of Contents

z/OS Cryptographic Services ICSF Application Programmer's Guide

Previous topic | Next topic | Contents | Contact z/OS | Library | PDF

Contents (exploded view)

z/OS Cryptographic Services ICSF Application Programmer's Guide
SA22-7522-16

Introducing Programming for the IBM CCA

Key Label

Linking a Program with the ICSF Callable Services

Introducing Symmetric Key Cryptography and Using Symmetric Key Callable Services

Functions of the Symmetric Cryptographic Keys

DES Key Flow

Generating and Managing Symmetric Keys

Common Cryptographic Architecture AES Key Management Services

Common Cryptographic Architecture HMAC Key Management Services

ECC Diffie-Hellman Key Agreement Models

Improved remote key distribution

Remote Key Loading

Remote key distribution scenario

Usage example

Remote key distribution benefits

Callable Services that Support Secure Sockets Layer (SSL)

Message Authentication Code Processing

Hashing Functions

Managing Personal Authentication

Verifying Credit Card Data

ANSI TR-31 key block support

Introducing PKA Cryptography and Using PKA Callable Services

Operational private keys

PKA Callable Services

Callable Services Supporting Digital Signatures

Callable Services for PKA Key Management

Callable Services to Update the Public Key Data Set (PKDS)

Callable Services for Working with Retained Private Keys

Callable Services for SET Secure Electronic Transaction

Introducing PKCS #11 and using PKCS #11 callable services

CCA Callable Services

Managing Symmetric Cryptographic Keys

Clear Key Import (CSNBCKI and CSNECKI)

Control Vector Generate (CSNBCVG and CSNECVG)

Control Vector Translate (CSNBCVT and CSNECVT)

Cryptographic Variable Encipher (CSNBCVE and CSNECVE)

Data Key Export (CSNBDKX and CSNEDKX)

Data Key Import (CSNBDKM and CSNEDKM)

Diversified Key Generate (CSNBDKG and CSNEDKG)

ECC Diffie-Hellman (CSNDEDH and CSNFEDH)

Key Export (CSNBKEX and CSNEKEX)

Key Generate (CSNBKGN and CSNEKGN)

Key Generate2 (CSNBKGN2 and CSNEKGN2)

Key Import (CSNBKIM and CSNEKIM)

Key Part Import (CSNBKPI and CSNEKPI)

Key Part Import2 (CSNBKPI2 and CSNEKPI2)

Key Test (CSNBKYT and CSNEKYT)

Key Test2 (CSNBKYT2 and CSNEKYT2)

Key Test Extended (CSNBKYTX and CSNEKTX)

Key Token Build (CSNBKTB and CSNEKTB)

Key Token Build2 (CSNBKTB2 and CSNEKTB2)

Key Translate (CSNBKTR and CSNEKTR)

Key Translate2 (CSNBKTR2 and CSNEKTR2)

Multiple Clear Key Import (CSNBCKM and CSNECKM)

Multiple Secure Key Import (CSNBSKM and CSNESKM)

PKA Decrypt (CSNDPKD and CSNFPKD)

PKA Encrypt (CSNDPKE and CSNFPKE)

Prohibit Export (CSNBPEX and CSNEPEX)

Prohibit Export Extended (CSNBPEXX and CSNEPEXX)

Random Number Generate (CSNBRNG, CSNERNG, CSNBRNGL and CSNERNGL)

Remote Key Export (CSNDRKX and CSNFRKX)

Restrict Key Attribute (CSNBRKA and CSNERKA)

Secure Key Import (CSNBSKI and CSNESKI)

Secure Key Import2 (CSNBSKI2 and CSNESKI2)

Symmetric Key Export (CSNDSYX and CSNFSYX)

Symmetric Key Generate (CSNDSYG and CSNFSYG)

Symmetric Key Import (CSNDSYI and CSNFSYI)

Symmetric Key Import2 (CSNDSYI2 and CSNFSYI2)

Transform CDMF Key (CSNBTCK and CSNETCK)

Trusted Block Create (CSNDTBC and CSNFTBC)

TR-31 Export (CSNBT31X and CSNET31X)

TR-31 Import (CSNBT31I and CSNET31I)

TR-31 Optional Data Build (CSNBT31O and CSNET31O)

TR-31 Optional Data Read (CSNBT31R and CSNET31R)

TR-31 Parse (CSNBT31P and CSNET31P)

User Derived Key (CSFUDK and CSFUDK6)

Protecting Data

Modes of Operation

Ciphertext Translate (CSNBCTT or CSNBCTT1 and CSNECTT or CSNECTT1)

Decipher (CSNBDEC or CSNBDEC1 and CSNEDEC or CSNEDEC1)

Decode (CSNBDCO and CSNEDCO)

Encipher (CSNBENC or CSNBENC1 and CSNEENC or CSNEENC1)

Encode (CSNBECO and CSNEECO)

Symmetric Algorithm Decipher (CSNBSAD or CSNBSAD1 and CSNESAD or CSNESAD1)

Symmetric Algorithm Encipher (CSNBSAE or CSNBSAE1 and CSNESAE or CSNESAE1)

Symmetric Key Decipher (CSNBSYD or CSNBSYD1 and CSNESYD or CSNESYD1)

Symmetric Key Encipher (CSNBSYE or CSNBSYE1 and CSNESYE or CSNESYE1)

Verifying Data Integrity and Authenticating Messages

How MDCs Are Used

HMAC Generate (CSNBHMG or CSNBHMG1 and CSNEHMG or CSNEHMG1)

HMAC Verify (CSNBHMV or CSNBHMV1 and CSNEHMV or CSNEHMV1)

MAC Generate (CSNBMGN or CSNBMGN1 and CSNEMGN or CSNEMGN1)

MAC Verify (CSNBMVR or CSNBMVR1 and CSNEMVR or CSNEMVR1)

MDC Generate (CSNBMDG or CSNBMDG1 and CSNEMDG or CSNEMDG1)

One-Way Hash Generate (CSNBOWH or CSNBOWH1 and CSNEOWH or CSNEOWH1)

Symmetric MAC Generate (CSNBSMG or CSNBSMG1 and CSNESMG or CSNESMG1)

Symmetric MAC Verify (CSNBSMV or CSNBSMV1 and CSNESMV or CSNESMV1)

Financial Services

ANSI X9.8 PIN Restrictions

The PIN Profile

PIN Block Format

PIN Block Format and PIN Extraction Method Keywords

Recommendations for the Pad Digit

Clear PIN Encrypt (CSNBCPE and CSNECPE)

Clear PIN Generate (CSNBPGN and CSNEPGN)

Clear PIN Generate Alternate (CSNBCPA and CSNECPA)

CVV Key Combine (CSNBCKC and CSNECKC)

Encrypted PIN Generate (CSNBEPG and CSNEEPG)

Encrypted PIN Translate (CSNBPTR and CSNEPTR)

Encrypted PIN Verify (CSNBPVR and CSNEPVR)

PIN Change/Unblock (CSNBPCU and CSNEPCU)

Secure Messaging for Keys (CSNBSKY and CSNESKY)

Secure Messaging for PINs (CSNBSPN and CSNESPN)

SET Block Compose (CSNDSBC and CSNFSBC)

SET Block Decompose (CSNDSBD and CSNFSBD)

Transaction Validation (CSNBTRV and CSNETRV)

VISA CVV Service Generate (CSNBCSG and CSNECSG)

VISA CVV Service Verify (CSNBCSV and CSNECSV)

Using Digital Signatures

Digital Signature Generate (CSNDDSG and CSNFDSG)

Digital Signature Verify (CSNDDSV and CSNFDSV)

Managing PKA Cryptographic Keys

PKA Key Generate (CSNDPKG and CSNFPKG)

PKA Key Import (CSNDPKI and CSNFPKI)

PKA Key Token Build (CSNDPKB and CSNFPKB)

PKA Key Token Change (CSNDKTC and CSNFKTC)

PKA Key Translate (CSNDPKT and CSNFPKT)

PKA Public Key Extract (CSNDPKX and CSNFPKX)

Retained Key Delete (CSNDRKD and CSNFRKD)

Retained Key List (CSNDRKL and CSNFRKL)

Key Data Set Management

CKDS Key Record Create (CSNBKRC and CSNEKRC)

CKDS Key Record Create2 (CSNBKRC2 and CSNEKRC2)

CKDS Key Record Delete (CSNBKRD and CSNEKRD)

CKDS Key Record Read (CSNBKRR and CSNEKRR)

CKDS Key Record Read2 (CSNBKRR2 and CSNEKRR2)

CKDS Key Record Write (CSNBKRW and CSNEKRW)

CKDS Key Record Write2 (CSNBKRW2 and CSNEKRW2)

Coordinated KDS Administration (CSFCRC and CSFCRC6)

PKDS Key Record Create (CSNDKRC and CSNFKRC)

PKDS Key Record Delete (CSNDKRD and CSNFKRD)

PKDS Key Record Read (CSNDKRR and CSNFKRR)

PKDS Key Record Write (CSNDKRW and CSNFKRW)

Utilities

Character/Nibble Conversion (CSNBXBC and CSNBXCB)

Code Conversion (CSNBXEA and CSNBXAE)

ICSF Query Algorithm (CSFIQA and CSFIQA6)

ICSF Query Facility (CSFIQF and CSFIQF6)

X9.9 Data Editing (CSNB9ED)

Trusted Key Entry Workstation Interfaces

PCI Interface Callable Service (CSFPCI and CSFPCI6)

PKSC Interface Callable Service (CSFPKSC)

Managing Keys According to the ANSI X9.17 Standard

ANSI X9.17 EDC Generate (CSNAEGN and CSNGEGN)

ANSI X9.17 Key Export (CSNAKEX and CSNGKEX)

ANSI X9.17 Key Import (CSNAKIM and CSNGKIM)

ANSI X9.17 Key Translate (CSNAKTR and CSNGKTR)

ANSI X9.17 Transport Key Partial Notarize (CSNATKN and CSNGTKN)

PKCS #11 Callable Services

Using PKCS #11 Tokens and Objects

PKCS #11 Derive multiple keys (CSFPDMK and CSFPDMK6)

PKCS #11 Derive key (CSFPDVK and CSFPDVK6)

PKCS #11 Get attribute value (CSFPGAV and CSFPGAV6)

PKCS #11 Generate key pair (CSFPGKP and CSFPGKP6)

PKCS #11 Generate secret key (CSFPGSK and CSFPGSK6)

PKCS #11 Generate HMAC (CSFPHMG and CSFPHMG6)

PKCS #11 Verify HMAC (CSFPHMV and CSFPHMV6)

PKCS #11 One-way hash, sign, or verify (CSFPOWH and CSFPOWH6)

PKCS #11 Private key sign (CSFPPKS and CSFPPKS6)

PKCS #11 Public key verify (CSFPPKV and CSFPPKV6)

PKCS #11 Pseudo-random function (CSFPPRF and CSFPPRF6)

PKCS #11 Set attribute value (CSFPSAV and CSFPSAV6)

PKCS #11 Secret key decrypt (CSFPSKD and CSFPSKD6)

PKCS #11 Secret key encrypt (CSFPSKE and CSFPSKE6)

PKCS #11 Token record create (CSFPTRC and CSFPTRC6)

PKCS #11 Token record delete (CSFPTRD and CSFPTRD6)

PKCS #11 Token record list (CSFPTRL and CSFPTRL6)

PKCS #11 Unwrap key (CSFPUWK and CSFPUWK6)

PKCS #11 Wrap key (CSFPWPK and CSFPWPK6)

Appendixes

Appendix A. ICSF and TSS Return and Reason Codes

Return Codes and Reason Codes

Appendix B. Key Token Formats

AES Key Token Formats

DES Key Token Formats

Variable-length Symmetric Key Token Formats

PKA Key Token Formats

RSA Private Internal Key Token

DSS Key Token Formats

ECC Key Token Format

Trusted Block Key Token

Appendix C. Control Vectors and Changing Control Vectors with the CVT Callable Service

Control Vector Table

Specifying a Control-Vector-Base Value

Changing Control Vectors with the Control Vector Translate Callable Service

Appendix D. Coding Examples

Appendix E. Using ICSF with BSAFE

Some BSAFE Basics

Appendix F. Cryptographic Algorithms and Processes

PIN Formats and Algorithms

PIN Extraction Rules

IBM PIN Algorithms

VISA PIN Algorithms

Cipher Processing Rules

Wrapping Methods for Symmetric Key Tokens

Partial Notarization

Visa and EMV-related smart card formats and processes

Key Test Verification Pattern Algorithms

Callable Service Access Control Points

Go to the next page

Notices | Terms of use | Support | Contact z/OS | zFavorites

Copyright IBM Corporation 1990, 2014