ZPCKEY(1)

🎀 zpckey — bestie edition 🎀

okay so you've landed on zpckey(1) from the General Commands Manual and honestly? you came to the right place. grab a snack, we're doing this together 💖

---

🌸 NAME 🌸

zpckey — a key management tooling for protected key origins, used by the OpenSSL provider for protected keys (the hbkzpc provider).

✨ SYNOPSIS ✨

three whole moods, pick your fighter:

zpckey [-h|–help] [-V|–version]

zpckey compose <REQ-ARGS> [<OPT-ARGS>] <ORIGIN-ARGS>

zpckey show <REQ-ARGS> [<OPT-ARGS>]

💜 DESCRIPTION 💜

so zpckey is the command that handles key management functions for protected key origins, and it's what the hbkzpc provider uses (that's hbkzpcprovider(7), more on that in SEE ALSO bestie 🫶).

and like — context matters here. IBM Z and IBM LinuxONE offer different types of cryptographic hardware with different features, including the CP Assist for Cryptographic Functions (CPACF) and the IBM Crypto Express (CEX) features. two icons, different job descriptions 💅

the CPACF provides functions to perform cryptographic operations with a kind of hardware-backed keys, the so called protected keys. that's the whole vibe.

the CEX cards, meanwhile? they provide secure key generation and storage (secure keys), as well as cryptographic operations with these keys. secure keys and protected keys are Not The Same and the docs are very clear about it, so respect the distinction fr fr.

---

⭐ OPTIONS ⭐

just the basics, no drama:

• -V, --version — Show version. the "who even am I" of flags 👑
• -h, --help — Show short help. for when you're lost but cute about it

---

🦋 ZPCKEY COMPOSE 🦋

okay so the compose command supports the composition of protected key origins, which can be used for the hbkzpc provider. this is the main character of the whole page ngl ✨

💅 Required Arguments:

these are non-negotiable, no skipping:

• -t, --origin-type <otype> — Protected key origin type
• -a, --origin-alg <oalg> — Protected key origin algorithm

🎀 Protected key origin types (<otype>):

literally so many choices (there is one):

• uv: Ultravisor retrievable secrets

🌈 Protected key origin algorithms (<oalg>):

okay this list ate, look at all these options:

• prime256v1 (alt.: 1.2.840.10045.3.1.7)
• secp384r1 (alt.: 1.3.132.0.34)
• secp521r1 (alt.: 1.3.132.0.35)
• ED25519 (alt.: 1.3.101.112)
• ED448 (alt.: 1.3.101.113)
• AES-128
• AES-192
• AES-256
• AES-128-XTS
• AES-256-XTS

the elliptic curves come with their whole OID government name as an alt, which is iconic tbh 🧚

🍓 Optional Arguments:

the nice-to-haves, the accessories of the fit:

• -p, --pubkey <file> — Public key file
• -o, --out <file> — Output file
• --outform <format> — Output file format URI, DER or PEM (default: PEM)
• -c, --comment <string> — Comment (metadata)
• -h, --help — Show short help

not me pointing out that --outform defaults to PEM — it does, quoted, default: PEM. don't forget it 💀

🌸 Origin Arguments:

okay listen, this part is conditional, so read it carefully:

For <otype> = uv, one out of the following must be specified:

• --uv-secret-id <hexstring> — UV secret ID
• --uv-secret-name <string> — UV secret name

"one out of" — so pick one, not both, not neither. this is a vibe check and the vibe is exactly one 🫶

---

🔥 ZPCKEY SHOW 🔥

the show command prints information about the key file to stdout. that's it, that's the whole job, and it's valid 💅

💖 Required Arguments:

• -i, --in <file> — Input file

like, you do have to tell it which file. that's the whole thing.

🌟 Optional Arguments:

• --inform <format> — Input file format PEM or DER (default: PEM)
• -h, --help — Show short help

lil reminder: for show the flag is --inform (input), and the default is PEM. for compose it was --outform (output), also defaulting to PEM. two different flags, both PEM by default, don't mix them up bestie 😭

---

🎀 SEE ALSO 🎀

go read these next, they're the supporting cast:

• hbkzpcprovider.conf(5)
• hbkzpcprovider(7)

---

and that's the whole page!! this beauty ships with LIBZPC v2 and it's dated 2026 — so yeah, fresh off the press, go compose some protected key origins and slay ✨💖🎀🦋

mwah, ily, rtfm responsibly 💜