A Public Key Extension to the Common Cryptographic Architecture

A new method for extending the iBM Common Crypt0 raphic Architecture (CCA) to include public fey cryptogra hy is presented. The public key extension roviAs nonrepudiation via digital signatures antan electronic means to distribute Data Enc ption Aigorithm (Dm) key-encrypting keys in aTybrid Data Enc ption Aigorithm-Public Ke Algorithm (DExPA cryptographic system. &e improvements are 6 ased on a novel method for extending the control vector concept used in the iBM Common Cryptographic Architecture. Four new key ty 8s that separate the public and private key pals into four classes according to their broad uses within the crypt0 raphic system are defined. The public key extensyon to the CCA is implemented in the iBM Transaction Security S stem (TSS). This paper dlscusses both the pu l ilc key extension to the CCA and the TSS implementation of this architectural extension. he IBM Common Cryptographic Architecture T (CCA) ' was first described in a series of pa-pers appearing in 1991.2- ' The CCA is based on the Data Encryption Algorithm (DEA) ~ and a method for controlling key usage, based on control vector~.~.'' The CCA consists of a set of cryptographic services supporting a wide range of data security applications-data confidentiality, data integrity, personal identification number (PIN) processing, and DEA key management. This set of services is accessible through an application programming interface (API) and is available on the IBM Enter