University:
Boston University
Course:
GRS CS 910 | Directed Study: Systems
Academic year:

2024
Views:

139

Pages:

14
Author:

Rednitz0bit

Overview of the z/OS Cryptographic Coprocessor • The Cryptographic Coprocessor hardware is implemented in CMOS technology on a single chip providing more capability than any previous cryptographic offering. • Included in the design is battery-backed nonvolatile memory storage, laser delete chip personalization, integrated tamper detection and response, and high speed DES, Triple DES, DSS, RSA, Pseudo Random Number Generation, and hashing algorithms. Cryptographic Coprocessor • The Cryptographic Coprocessor Feature includes one or two cryptographic coprocessor chips protected by tamper-detection circuitry and a cryptographic battery unit. Cryptographic Coprocessor • Dual Cryptographic Coprocessors on Dyadics and above: Each Cryptographic Coprocessor attaches to two Central Processors to help maximize availability for CP failure events. • SET Support: Secure Electronic Transaction (SET) is a protocol developed jointly by VISA International and MasterCard to help safeguard payment card purchases made over open networks. • PKA Cryptographic Key Data Set: ICSF now provides a storage data set for Public Key Algorithm (PKA) private and public keys. Cryptographic Coprocessor • Support for CVV and CVC: VISA and MasterCard have specified a cryptographic method of calculating a value that relates to information on a payment card, such as the personal account number (PAN), the card expiration date, and the service code • Double-Key MAC Support: The ANSI X9.19 MAC Procedure is supported by ICSF. This requires the use of a double-length key for MAC processing • Triple DES (TDES): DES encryption for ICSF has been enhanced to now include TDES (168 bits) encryption • Awarded the U.S. government's highest certification for commercial security Integrated Cryptographic Service Facility Overview • ICSF works with the hardware cryptographic feature and the Z/OS Security Server to provide secure high-speed cryptographic services in the Z/OS environment. • The Integrated Cryptographic Service Facility provides the application programming interfaces by which applications request the cryptographic services to the cryptographic feature. The cryptographic feature is a secure high-speed hardware that performs the actual cryptographic functions. • ICSF runs as a started task and has its own address space and a data space. • Balanced, expandable support for secure Web serving. • Greatly improves SSL transaction throughput making secure, high performance e-business applications easier to implement ICSF Provides Services For: • Entering keys into both the tamper-resistant hardware and the cryptographic key data set (CKDS and PKDS). Even the final steps of Master Key entry from TKE are performed through ICSF • Managing and creating cryptographic keys for application use • For public key cryptography, Z/OS ICSF supports both the RSA algorithm and the NIST Digital Signature Standard Application Program Interfaces • • • • Full DES with PKA DES with exportable PKA CDMF with exportable PKA Supporting the ANSI X9.17 key management standard • Distributing DATA keys enciphered under a RSA key • Generating and verifying digital signatures • Composing and decomposing SET blocks Algorithms Supported on Z/OS • Encryption / Decryption – DES (Data Encryption Standard) • Symmetric, 64 block cipher • 56 bit key size – Triple DES • “DES times 3” with three different keys (K1, K2, K3) • Equivalent to 168 bit key size More Algorithms on Z/OS • Encryption / Decryption – AES (Advanced Encryption Standard) • • • • • • Symmetric Supports 128, 192 and 256 bit key sizes Blowfish Symmetric block cipher Variable length key from 32-448 bits Standard (16 round) and Fast (10 round) Modes More Algorithms on Z/OS • Encryption / Decryption – For all Symmetric Algorithms, the Following Modes are Supported: • ECB (Electronic Codebook) • CBC (Cipher Block Chaining) • CFB (Cipher Feedback) More Algorithms on Z/OS • Encryption / Decryption – Cast • DES-like (16 round) • Used extensively by PGP and GnuPG – Diffie-Hellman Elgamal • Used for public key encryption – RSA • uses modular & exponential arithmetic • Used for public key and digital signature encryption More Algorithms on Z/OS • Digital Signature – DSA (Digital Signature Algorithm) – RSA (Rivest/Shamir/Adelman algorithm) – Secure Sockets Layer – Available as a port to the Unix Systems Services side of Z/OS. – Secure Shell – Available as a port to the Unix Systems Services side of Z/OS. – Kerberos – has been available since earlier release of OS/390. Some New Technology • Quantum Cryptography is a method for secure key exchange over an insecure channel based on the nature of photons. • DNA Computing, also known as molecular computing, is a new approach to massively parallel computation based on ground-breaking work by Adleman. • Biometric Techniques applies to a broad range of electronic techniques that employ the physical characteristics of human beings as a means of authentication. Evaluating Cryptograph Software • • • • Which information needs to be protected? How well does it need to be protected? Is encryption of the data better than other possibilities? Who will maintain the encryption keys and be responsible for performing the encryption and decryption? • Who might attempt to gain access to the information, and what level of cryptanalytic skills might they possess? • What methods of encryption are available, how much do they cost and what are their merits? • Should different methods of encryption be used for different kinds of information? • Is the software compatible with the hardware and the operating system that it is to be used on? Reference hermetic.nofadz.com/crypto/eval.htm for these and other Observations.

Overview of the z OS Cryptographic Coprocessor

Related Documents

Recommended Documents

Description

Related Documents

Free up your schedule!

Take 5 seconds to unlock