Z/OS: Trusted Key Entry Workstation (tke)

Smart card usage
Table 1 indicates in more detail where CA smart cards created in different releases can be used. Usage
means employing a CA smart card to create TKE smart cards, creating a backup CA smart card, or
enrolling a TKE workstation cryptographic adapter in the zone. OmniKey smart card readers are required
to use CA smart cards with a zone key length of 2048-bits.
Table 5. CA smart card usage
Use on TKE 5.2 or
earlier
Use on TKE 5.3
Use on TKE 6.0
Use on TKE 7.0
and later
Created on TKE
5.2 or before
Yes
Yes
Yes
No
Created on TKE
5.3
No
Yes
Yes
Yes
1
Created on TKE
6.0, 1024-bit zone
key
No
Yes
Yes
Yes
1
Created on TKE
6.0, 2048-bit zone
key
No
No
Yes
Yes
Created on TKE
7.0 and above
No
No
No
Yes
1
You must use smart cards associated with part number 45D3398 or 74Y0551 in this release of TKE.
Datakey smart cards are not supported in TKE 7.0 and above.
Table 2 indicates in more detail where TKE smart cards created in different releases can be used. Usage
means employing a TKE smart card to store or load key parts or to generate and retain an authority
signature key or a crypto adapter logon key, to copy keys and key parts from one smart card to another, to
log on to the TKE workstation crypto adapter, or to create a profile for the TKE workstation crypto adapter.
The TKE smart card must be enrolled in the zone where it is used, although this is not required to use the
authority signature key or crypto adapter logon key on the smart card. The authority signature key and the
crypto adapter logon key are not subject to zone constraints.
Table 6. TKE smart card usage