AES PIN support for the German banking industry PKA Translate UDX function into CCA Support for the updated German Banking standard (DK) The German banking industry organization, DK, defined a new set of PIN processing  functions to be used on the internal systems of banks and their servers. CCA is designed to  support the functions that are essential to those parts of the German banking industry that  are governed by DK requirements. The functions include key management support for new  AES key types, AES key derivation support, and several DK-specific PIN and administrative  functions. This support includes PIN method APIs, PIN administration APIs, new key management  verbs, and new access control points support that is needed for DK-defined functions. The following requirements must be met to use AES PIN support: Update support requires ICSF WD18 (HCR77D0) for z/OS V2R2 and V2R3 for: UDX is custom code that allows the client to add unique operations or extensions to the CCA  firmware. Certain UDX functions are integrated into the base CCA code over time to  accomplish the following tasks: GLYPH<SM590000> Hardware: – z15 systems and Crypto Express7S (Crypto Express6S with CCA V6.0 firmware or  Crypto Express5S with CCA V5.2 firmware are also supported) – z14 systems and Crypto Express6S with CCA V6.0 firmware or Crypto Express5S with  CCA V5.2 – z13s systems and Crypto Expr ess5S with CCA V5.2 firmware – z13 systems and Crypto Express5S with CCA V5.0 or later firmware GLYPH<SM590000> Operating systems requirements for z15: – z/OS: All functions require ICSF WD18 (H CR77D0), unless otherwise noted. WD18  supports z/OS V2R1, V2R2, and V2R3; WD19 (HCR77D1 is required for z/OS V2R4. – z/VM Version 6.4 with PTFs for guest use. GLYPH<SM590000> CCA 5.4 & 6.1$^{7}$: – ISO-4 PIN Blocks (ISO-9564-1). – Directed keys: A key can encrypt or decrypt data, but not both. – Allow AES transport keys to  be used to export/import  DES  keys in a standard ISO  20038 key block. This feature helps with interoperability between CCA and non-CCA  systems. – Allow AES transport keys to be used to  export/import a small subset of  AES  keys in a  standard ISO 20038 key block. This feature helps with interoperability between CCA  and non-CCA systems.  – Triple-length TDES keys with Control Vectors for increased data confidentiality. GLYPH<SM590000> CCA 5.5: DK Random PIN Generate2 and DK PRW Card Number Update2. GLYPH<SM590000> CCA 6.2: PCI HSM 3K DES: Support for triple length DES keys (standards compliance). GLYPH<SM590000> Remove headaches and challenges that are associated with UDX management and  currency. 7 CCA 5.4 and 6.1 enhancements are also supported for z/OS V2R1 with ICSF HCR77C1 (WD17) with Small  Program Enhancements (SPEs) (z/OS continuous delivery model). Chapter 6. Cryptographic features  239