PKCSCCA(1)

💖 PKCSCCA(1) 💖

okay bestie, so this is the manual page for pkcscca — a Gen Z–approved guide to the CCA token config utility, from your friends over in openCryptoki. grab a strawberry 🍓 drink and let's get into it.

---

✨ NAME ✨

pkcscca — configuration utility for the CCA token

no cap, that's the whole vibe. it configures. it's the CCA token's little helper. 💅

---

🌸 SYNOPSIS 🌸

🦋 VERSION MIGRATION

pkcscca [-m v2objectsv3] [OPTIONS]

🦋 KEY MIGRATION

pkcscca [-m keys] [-s SLOTID] [-k aes|apka|asym|sym] [OPTIONS]

🦋 OLD RSA KEY MIGRATION

pkcscca [-m oldrsakeys] [-s SLOTID] [OPTIONS]

---

💫 DESCRIPTION 💫

The pkcscca utility is here to help you admin the CCA token. like, it literally assists in administering the CCA token. main character energy for your token objects, honestly. 👑

okay so back in version 2 of opencryptoki, CCA private token objects were encrypted in CCA hardware. in version 3? they're encrypted in software instead. glow-up, honestly. the v2objectsv3 migration option moves these v2 objects over by decrypting them in CCA hardware using a secure key, and then re-encrypting them in software using a software key. after that, v2 objects can be accessed in version 3. slay. ✨

now, sometimes CCA master keys just have to be changed. it happens. and here's the tea: all CCA secret and private keys are wrapped with a master key. so after a CCA master key gets changed, any keys wrapped with the old master key need to be re-wrapped with the current master key. the keys migration option handles that — it unwraps them with the old master key and wraps them with the current one. lowkey elegant. 🎀

and one more thing, because there's history here. up to opencryptoki version 3.14.0, RSA keys were created using the RSA-CRT key token format (private key section X'08'). RSA-CRT keys are encrypted with the CCA ASYM master key, and can not be used for certain mechanisms, e.g. RSA-PSS or RSA-OAEP. so if you were wondering why your fave mechanism wasn't working… that's why. 🙈

in newer opencryptoki versions, RSA keys are created using the RSA-AESC key token format (private key section X'31'). and up to version 3.16.0, RSA public keys also contained full CCA secure key tokens, including the private key section (which is encrypted by the CCA master key). the oldrsakeys migration option migrates old RSA private key tokens to the new format, and also extracts the public key sections from RSA public key tokens that contain a full CCA secure key token. it's giving cleanup era. 🧚

---

🌈 GENERAL OPTIONS 🌈

• -d|--datastore directory — the directory where the CCA token information is kept. this directory gets used to locate the private token objects to be migrated, i.e. /var/lib/opencryptoki/ccatok. yes, that exact one. 📁
• -v|--verbose — provide more detailed output. more words, more lore, more clarity. 🔍

---

💜 VERSION MIGRATION 💜

• -m v2objectsv3 — migrates CCA private token objects from CCA encryption (used in v2) to software encryption (used in v3). the classic glow-up pipeline. ✨

---

🔥 KEY MIGRATION 🔥

• -m keys — unwraps private keys with an old CCA master key and wraps them with a new CCA master key.
• -k aes|apka|asym|sym — migrate keys wrapped with the selected master key type.
• -s|--slotid SLOTID — the PKCS slot number.

---

🫶 OLD RSA KEY MIGRATION 🫶

• -m oldrsakeys — converts old RSA keys (RSA-CRT) to the new format (RSA-AESC) and extracts the public key section only from key objects containing the full RSA key token.
• -s|--slotid SLOTID — the PKCS slot number.

---

🍓 FILES 🍓

• /var/lib/opencryptoki/ccatok/TOK_OBJ/OBJ.IDX — contains current list of public and private token objects for the CCA token. it's the index, bestie, treat it with respect. 💖

---

🌟 SEE ALSO 🌟

• README.cca_stdll (in system's doc directory)

---

heads up: the migration stuff touches real keys and real token objects, so know what you're migrating before you send it. iykyk. 💀

okay that's the whole page, and it's a whole mood. this was openCryptoki 3.27.0, dated September 2014 — iconic then, iconic now. periodt. 👑💅🌈