Filter
Top Products
CCA Release 2.54
Protecting Your Transaction Information
When you are logged on to the Coprocessor, the information transmitted to and
from the CCA Coprocessor application is cryptographically protected using your
session key. A message authentication code is used to ensure that the data was
not altered during transmission. Since this code is calculated using your session
key, it also verifies that you are the originator of the request, not someone else
attempting to impersonate you.
For some verbs, it is also important to keep the information secret. This is
especially important with the Access_Control_Initialization verb, which is used to
send new role and profile data to the Coprocessor. To ensure secrecy, some verbs
offer a special protected option, which causes the data to be encrypted using your
session key. This prevents disclosure of the critical data, even if the message is
intercepted during transmission to the Coprocessor.
Controlling the Cryptographic Facility
There are six verbs that you can call to manage aspects of the CCA Coprocessor.
One of these, the Key_Storage_Designate verb, is unique to the OS/400
implementation and allows you to select among key-storage files.
The Cryptographic_Facility_Query verb enables you to obtain the status of the CCA
node. You specify one of several status categories, and the verb returns that
category of status. Status information you can obtain includes:
The condition of the master-key registers: clear, full, and so forth. Note that the
extended CCA status returns information about both the symmetric and the
asymmetric master-key-register sets.
The role name in effect for your processing thread.
Information about the Coprocessor hardware including the unique eight-byte
serial number. This serial number is also printed on the label on the
Coprocessor's mounting bracket.
The state of the Coprocessor's battery: OK or change the battery soon.
Various tamper indications. Note that this information is also returned in
X'8040xxxx' status messages, for example, when you use the Coprocessor
Load Utility.
Time and date from the Coprocessor's internal clock.
The Environment Id (EID), which is a 16-byte identifier used in the PKA92 key
encryption scheme and in master-key cloning. You assign an EID to represent
the Cryptographic Coprocessor.
Diagnostic information that could be of value to product development in the
event of malfunction.
The Cryptographic_Facility_Control verb enables you to:
Reinitialize (“zeroize”) the CCA node. This is a two-step process that requires
your application to compute an intermediate value as insurance against any
inadvertent reinitialize action.
Set parameters into the CCA node, other than those related to the
access-control system, including: the date and time, the function control vector
Chapter 2. CCA Node-Management and Access-Control 2-9