H.3.2 Key Serving Topology - IBM z13s Technical Manual

During the alternate SE initialization, application programming interfaces (APIs) are called to
initialize the alternate smart card in it with the applet code and create the RSA public/private
key pair. The API returns the public key of the smart card that is associated with the alternate
SE. This public key is used to encrypt the KEK and the Flash encryption key/authentication
key from the primary SE. The resulting encrypted file is sent to the alternate SE for
redundancy.

H.3.2 Key serving topology

In a key serving topology, the SE is the key server and the IKC is the key manager. The SE is
connected to the firmware management of the Flash Express adapter through a secure
communications line. The firmware manages the transportation of the Flash encryption
key/authentication key through internal system paths. Data in the adapter cache memory is
backed up by a flash-backed DRAM module. This module can encrypt the data with the Flash
encryption key/authentication key.
The firmware management of the Flash Express adapter generates its own transport RSA
asymmetric key pair. This pair is used to wrap the Flash encryption key/authentication key
while in transit between the SE and the firmware code.
Figure H-7 on page 538 shows the following key serving topology:
1. The firmware management of the Flash Express adapter requests the Flash encryption
key/authentication key from the SE at IML time. When this request arrives, the firmware
public key is passed to the SE to be used as the transport key.
2. The file that contains the KEK-encrypted Flash encryption key/authentication key and the
firmware public key is passed to the IKC. The IKC sends the file contents and the public
key to the smart card.
3. The applet on the smart card decrypts the file contents and the Flash encryption
key/authentication key. It then re-encrypts the Flash encryption key/authentication key with
the firmware public key.
4. This encrypted key is then passed back to the SE, which forwards it on to the firmware
management of the Flash Express adapter code.
Appendix H. Flash Express
537