CPACF facilitates the continued privacy of cryptographic key material when used for data  encryption. In Crypto Express6S or Express5S coprocessors, a secure key is encrypted  under a master key. However, a protected key is encrypted under a wrapping key that is  unique to each LPAR.  Because the wrapping key is unique to each LPAR, a protected key cannot be shared with  another LPAR. By using key wrapping, CPACF ensures that key material is not visible to  applications or operating systems during encryption operations. CPACF code generates the wrapping key and stores it in the protected area of the hardware  system area (HSA). The wrapping key is accessible only by firmware. It cannot be accessed  by operating systems or applications. DES/T-DES and AES algorithms are implemented in  CPACF code with the support of hardware assist functions. Two variations of wrapping keys  are generated: One for DES/T-DES keys and another for AES keys.  Wrapping keys are generated during the clear reset each time an LPAR is activated or reset.  No customizable option is available at Support Element (SE) or Hardware Management  Console (HMC) that permits or avoids the wrapping key generation. This function flow is  shown in Figure 6-5. If a Crypto Express6S coprocessor (CEX6C) or Express5S coprocessor (CEX5C) is  available, a protected key can begin its life as a secure key. Otherwise, an application is  responsible for creating or loading a clear key value, and then uses the PCKMO instruction to  wrap the key. ICSF is not called by the application if the CEX6C or CEX5C is not available.  A new segment in the profiles of the CSFKEYS class in IBM RACF restricts which secure  keys can be used as protected keys. By default, all secure keys are considered not eligible to  be used as protected keys. The process that is shown in Figure 6-5 considers a secure key as  being the source of a protected key.  CPACF DK$_{TK}$ => DK$_{CPACFWK}$ ICSF IBM Z Firmware Secure Key Secure Key - DK$_{CCAMK}$ DK$_{CCAMK }$ Rewrapped Key - DK$_{TK}$ EXPT-SK (Secure Key -DK$_{CCAMK}$ ) Rewrapped Key  DK$_{TK}$ CPACF Wrapped Key DK$_{CPACFWK}$ CPACF Wrapped Key DK$_{CPACFWK}$ CPA C F Wrapping Key (CPACFWK) Software Hardware + Firmware CK DS Transport Key (TK) 1 2 3 DK$_{CCMK}$ => DK$_{TK}$ CCA Master Key (CCAMK) Transport Key (TK) 4 5 6 7 8 Figure 6-5 CPACF key wrapping with Crypto Express6S Chapter 6. Cryptographic features  219