IBM 4770 PCIe Cryptographic Coprocessor (4770-001)

https://www.ibm.com/docs/en/cryptocards
Admin
The IBM 4770 PCIe Cryptographic Coprocessor (4770-001) is a hardware security module (HSM) designed...
Tokens:43,798
Snippets:263
Trust Score:10
Update:10 months ago
Show doc for...
Tokens:
Raw
### CCA Release 5.5.6 Overview

Source: https://www.ibm.com/docs/en/cryptocards/index_topic=4767-cca-releases

Overview of the CCA Release 5.5.6, including supported platforms and a summary of key enhancements.

```APIDOC
## CCA Release 5.5.6

**Supported Platforms:**
- Red Hat Enterprise Linux (RHEL) Server (64-bit) 7.5
- SUSE Linux Enterprise Server (SLES)

**Summary of Enhancements:**
- Introduction of Cryptographic Hardware Initialization and Maintenance (CHIM) utility for remote management.
- Enhancements to AES MAC key handling in `Key_Token_Build2` and `Key_Token_Parse2`.
- Updates to `Encrypted_PIN_Translate2` for AES MAC VERIFY key usage.
- Enhanced `Key_Test2` verb for master key value verification.
- New direction/initiation rule-array keywords for `Unique_Key_Derive` verb.
- Addition of `DK_PRW_Card_Number_Update2` verb for PIN reference value updates.
- Addition of `DK_Random_PIN_Generate2` verb for random PIN generation.
- Enhancements to `TR31_Key_Import` verb for importing specific key types.
```

--------------------------------

### Key Token Management Enhancements

Source: https://www.ibm.com/docs/en/cryptocards/index_topic=4767-cca-releases

Details on enhancements related to AES MAC key handling in `Key_Token_Build2`, `Key_Token_Parse2`, and `Encrypted_PIN_Translate2`.

```APIDOC
## Key Token Management Enhancements

### Description
This section details enhancements to key token management, specifically focusing on AES MAC keys with VERIFY usage.

#### Key_Token_Build2 Enhancements
- A new rule-array keyword group `authentication data verification` is added for AES MAC keys.
- This allows specifying whether the key can be used by `Encrypted_PIN_Translate2` to verify authentication data using NIST SP 800-38B CMAC for ISO-4 to ISO-PAN change.

#### Key_Token_Parse2 Enhancements
- `Key_Token_Parse2` can now parse an AES MAC key with authentication data verification key usage.
- It returns either `PTR2AUTH` or `NOP2AUTH` if the key has a VERIFY key usage.

#### Encrypted_PIN_Translate2 Enhancements
- This verb can now require the AES MAC VERIFY authentication key to have `PTR2AUTH` usage for ISO-4 to ISO-4 PAN change authentication.
- For backward compatibility, a new access control command `PTR2 PAN Change Authentication Requires PTR2AUTH Usage` (offset X'0395') must be enabled in the active role.
- If offset X'0395' is not enabled, a warning message is returned if the `PTR2AUTH` key usage is ignored.

### Method
N/A (Description of verb behavior)

### Endpoint
N/A

### Parameters
N/A

### Request Example
N/A

### Response
N/A
```

--------------------------------

### Cryptographic Hardware Initialization and Maintenance (CHIM) Utility

Source: https://www.ibm.com/docs/en/cryptocards/index_topic=4767-cca-releases

Details on the new CHIM utility, designed for remote initialization and maintenance of IBM Cryptographic Coprocessors, as a replacement for CNM.

```APIDOC
## CHIM Utility

### Description
The Cryptographic Hardware Initialization and Maintenance (CHIM) utility is a new host utility introduced in Release 5.5.6. It provides enhanced capabilities for the remote initialization and maintenance of IBM Cryptographic Coprocessors. CHIM is designed to replace the existing Cryptographic Node Management (CNM) utility and offers the advantage of managing multiple remote IBM Cryptographic Coprocessors.

### Method
N/A (This is a utility description, not an API endpoint)

### Endpoint
N/A

### Parameters
N/A

### Request Example
N/A

### Response
N/A
```
Tokens:
Raw