ClearPath OS 2200 Series Release 13.2 Software Planning and ...

ClearPath OS 2200 Release 13.1
Cipher API Level 2R2
Compatibility
Cipher API
Cipher API 2R2 is fully compatible with data encrypted by previous levels. The FIPScertified
algorithms used by Cipher API 2R2 are fully compatible with APIs supported in
previous levels, so previously-encrypted data can be safely and accurately decrypted
using this level of Cipher API.
Cipher API encryption calls that use dynamic mode will use either hardware or software,
whichever is faster for the specified algorithm, data format, and data size. The
CIP2001-PCE encryption card available on the Dorado 800 through I/O Manager has
different latency and speed compared with the CIP1001-PCX encryption card attached to
an SIOP or SCIOP on other Dorado servers. Therefore, the ranges in which Cipher API
uses hardware versus software encryption are different for the two cards. To derive
maximum efficiency from Cipher API, the correct configuration file must be loaded. Use
the new installation Mode B for servers having I/O Manager; using this mode
automatically loads the correct configuration file for use with the CIP2001-PCE
encryption card. If no encryption card is installed, the choice of Mode A or Mode B
makes no difference, but by using Mode B on systems such as the Dorado 800 that
support I/O Manager, you are prepared for adding a CIP2001-PCE card later without
having to change the Cipher API configuration file.
Migration
The OS 2200 Cryptographic Library (CryptoLib) must be installed for Cipher API to run.
Levels of Cipher API prior to 2R1 did not require CryptoLib.
ClearPath OS 2200 Release 13.0
Cipher API Level 2R1
Compatibility
Cipher API 2R1 is fully compatible with data encrypted by previous levels. The
FIPS-certified algorithms used by Cipher API 2R1 are fully compatible with the previous
APIs, so previously-encrypted data can be safely and accurately decrypted using this
level of Cipher API.
The Initialization Vector (IV) that can be specified on the command line call in Cipher API
2R1 is optional. Runstreams using the Cipher API 1R3A version of the command line will
continue to work correctly with Cipher API 2R1.
The new ("level 2") and old ("level 1") API calls are supported concurrently. But any
particular program must use only one or the other set of APIs. Users of the new API calls
are cautioned that if they provide their own Initialization Vector, they will not be able to
decrypt the data using the older APIs.
The OS 2200 Cryptographic Library (CryptoLib) must be installed for Cipher API 2R1 to
run, even if the level 1 APIs are used.
7831 0349–043 5–3