Filter
Top Products
CCA Release 2.54
AIX and Windows Multi-Coprocessor Master-Key Support: It is a general
recommendation that all of the CCA Coprocessors within the system use the same
current and old master keys. When setting a new master-key, it is essential that all
of the changes are performed by a single program running on a single thread. If
the thread-process is ended before all of the Coprocessor master-keys are
changed, significant complications can arise. It is suggested that you start the
CNM utility and use it to make all of the changes before you end the utility.
If you fail to change all of the master keys with the same program running on the
same thread, either because there is an unplanned interruption, or perhaps
because you intend to have different master keys between Coprocessors, you need
to understand the design of the CCA host code that is described next.
CCA Host Code Design: (AIX and Windows) CCA keeps a copy of the symmetric
or the asymmetric current-master-key verification pattern in the key-storage header
records. This information is used to ensure that a given key-storage file is
associated with a Coprocessor having the same current master-key. This can
prevent accessing an out-of-date key-storage backup file. The verification pattern
is written into the header record when key storage is initialized, and when the
current master-key is changed in a Coprocessor.
CCA also keeps two flags in memory associated with a host-processing thread. If
there are multiple threads, each thread has its own set of flags. The flags,
symmetric-directory-open (SDO) and asymmetric-directory-open (ADO), are set to
false when CCA processing begins on the thread.
When a CCA verb is called and a key storage is referenced, and if the associated
flag (SDO or ADO) is false, CCA obtains the verification pattern for the current
master-key and compares this to the header-record information. If the patterns
match, the flag is set to true, and processing continues. If the existing patterns do
not match, processing is terminated with an error indication. If there is no current
master-key or if key storage has not been initialized, processing continues
although, depending on the CCA verb, other error conditions may arise.
A key-storage reference occurs in two cases:
1. When the verb call employs a key label
2. When the SET master-key option is used on the Master_Key_Process verb.
Situations to Consider: Given the design of the host code, when you employ
multiple Coprocessors with CCA, you should consider the following cases in regard
to master keys. Remember that if you explicitly manage the symmetric or the
asymmetric master keys (using the SYM-MK or ASYM-MK keywords on the
Master_Key_Process verb), you have both master keys and both key storages to
consider. If you do not explicitly manage the two classes of master keys, then the
implementation will operate as though there is a single set of master keys. The
CNM utility provided with the CCA Support Program does not explicitly manage the
two sets of keys and the program design assumes that the master keys have
always been managed without explicit reference to the symmetric or the
asymmetric keys.
Setting master keys in multiple Coprocessors.
If, as recommended, you keep the master keys the same in all of the CCA
Coprocessors, and you set the master key in each of the Coprocessors from a
single program running on the same thread, the following will take place:
2-18 IBM 4758 CCA Basic Services, Release 2.54, February 2005