Overview
This article will discuss the necessary prerequisites in order to properly run the CRYSTALS-Kyber and CRYSTALS-Dilithium quantum-safe algorithms with IBM Semeru. Much of the information in this article was inspired by the IBM Redbook Transitioning to Quantum-Safe Cryptography on IBM Z and will be referenced throughout to provide more detailed information where needed.
Step 1: Download an IBM Semeru JDK
An IBM Semeru JDK must first be installed on your IBM Z system. Specifically, versions Java 11.0.22 or Java 17.0.10 or later must be downloaded to run QSC algorithms. QSC is not supported on Java 8. For more information, see [2].
Additionally, see section How to obtain an IBM Semeru JDK for steps and links to downloading a JDK on your system.
Step 2: Run on IBM z16
IBM z16 provides quantum-safe APIs that can be used to protect data. These APIs are available through ICSF and the CCA APIs, which are then made available in the IBM Semeru JDK. "IBM z16 adds features to protect the system from attacks, including threats that might use quantum computers." IBM Semeru only supports QSC calls when an IBM z16 is used.
Step 3: Install ICSF HCR77D2 (z/OS 2.5) or later
IBM Semeru QSC functionality relies on the availability and proper functioning of ICSF. Full QSC support was delivered with ICSF HCR77D2 (z/OS 2.5). You must ensure your IBM Z system has z/OS 2.5 and, in turn, ICSF version HCR77D2 to properly call the CRYSTALS algorithms.
Step 4: Equip a Crypto Express8S coprocessor or later
Full support for the CRYSTALS algorithms was added to the Crypto Express8S (CEX8S) coprocessors and are a required Hardware Security Module (HSM) to run these algorithms. See Table 4-2 in [1] for a breakdown of each algorithm and its respective hardware and software prerequisites for ICSF. However, from the perspective of IBM Semeru, a CEX8S coprocessor is the minimum cryptographic hardware to run QSC with Java.
Step 5: Convert your PKDS to KDSRL format
If a PKDS is allocated and you want to store CRYSTALS-Kyber or CRYSTALS-Dilithium CCA key tokens, you must convert your PKDS over to a large common record format (KDSRL) [1].
Considering QSC keys are extremely large in size, the PKDS must be configured to accommodate these new key types. KDSRL format increases the logical record length (LRECL) of the PKDS. If you plan to store CCA QSA key tokens in your ICSF PKDS, you must be on ICSF HCR77D2 and have a KDSRL PKDS [1].
Step 6: Enable CPACF feature code 3863
"z/OS Integrated Cryptographic Services Facility (ICSF) uses CPACF to accelerate cryptographic functions. For ICSF to use these functions, Feature Code (FC) 3863 must be enabled. This FC is not enabled by default" [1].
Conclusion
This article should give you everything you need to configure your IBM Z environment and begin using the CRYSTALS-Kyber and CRYSTALS-Dilithium quantum-safe capabilities in your Java applications. You are taking the first step in protecting your applications from the inevitable risk of quantum computers.
References
- Transitioning to Quantum-Safe Cryptography on IBM Z
- Semeru for zOS, V11.0.22.0 and V17.0.10.0 GA!
How to obtain an IBM Semeru JDK
The IBM Java SAF APIs are included in the IBM Semeru Runtime Certified Edition for z/OS download. Please follow the links below to download the IBM Semeru JDK onto your own machines.
How to obtain IBM Semeru Runtime Certified Edition for z/OS?
IBM Semeru Runtime Certified Edition for z/OS is available for zero license charge through Shopz SMP/E, or you can download the non-SMP/E here. The subscription and service number is 5655-I48.
Supporting Links:
IBM Semeru Runtime Certified Edition for z/OS product page
For additional information on installation, troubleshooting and support please visit IBM Documentation.