IBM Computer Hardware 2 User Manual download pdf (Page 436)

CCA Release 2.54

Changing Control Vectors with the Control_Vector_Translate Verb

Do the following when using the Control_Vector_Translate verb:

 Provide the control information for testing the control vectors of the source,

target, and key-encrypting keys to ensure that only sanctioned changes can be

performed

 Select the key-half processing mode.

Providing the Control Information for Testing the Control

Vectors

To minimize your security exposure, the Control_Vector_Translate verb requires

control information (mask array information) to limit the range of allowable control

vector changes. To ensure that this verb is used only for authorized purposes, the

source-key control vector, target-key control vector, and key-encrypting key (KEK)

control vector must pass specific tests. The tests on the control vectors are

performed within the secured cryptographic engine.

The tests consist of evaluating four logic expressions, the results of which must be

a string of binary zeros. The expressions operate bit-for-bit on information that is

contained in the mask arrays and in the portions of the control vectors associated

with the key or key-half that is being processed. If any of the expression

evaluations do not result in all zero bits, the verb is ended with a control vector

violation return and reason code (8/39). See Figure C-8. Only the 56 bit positions

that are associated with a key value are evaluated. The low-order bit that is

associated with key parity in each key-byte is not evaluated.

Mask Array Preparation

A mask array consists of seven 8-byte elements: A

, B

, A

, B

, A

, B

, and B

You choose the values of the array elements such that each of the following four

expressions evaluates to a string of binary zeros. (See Figure C-8 on page C-22.)

Set the A bits to the value that you require for the corresponding control vector bits.

In expressions 1 through 3, set the B bits to select the control vector bits to be

evaluated. In expression 4, set the B bits to select the source and target control

vector bits to be evaluated. Also, use the following control vector information:

is the control vector associated with the left half of the KEK.

is the control vector associated with the source key, or selected source-key

half/halves.

is the control vector associated with the target key or selected target-key

half/halves.

1. (C

exclusive-OR A

) logical-AND B

This expression tests whether the KEK used to encipher the key meets your

criteria for the desired translation.

2. (C

exclusive-OR A

) logical-AND B

This expression tests whether the control vector associated with the source key

meets your criteria for the desired translation.

3. (C

exclusive-OR A

) logical-AND B

This expression tests whether the control vector associated with the target key

meets your criteria for the desired translation.

4. (C

exclusive-OR C

) logical-AND B

C-20 IBM 4758 CCA Basic Services, Release 2.54, February 2005

1 2 ... 431 432 433 434 435 436 437 438 439 440 441 ... 507 508

Comments to this Manuals

No comments

IBM Computer Hardware 2 User Manual Page 436

Comments to this Manuals

Related products and manuals for Software IBM Computer Hardware 2