This is performed by a process of splitting the master key into n shares, where n is a number from 1 to 15. m shares are required to rebuild the master key in another Coprocessor, where m is a number from 1 to 15 and less than or equal to n.

The term "cloning" is used to differentiate the process from "copying" because no one share, or any combination of fewer than m shares, provide sufficient information needed to rebuild the master key.

The Coprocessor containing the master key to be cloned is referred to as either the master-key-share source node or the Sender. The Sender must generate a retained RSA key pair. This private key must also have been marked as suitable for use with cloning when it was generated. The key is known as either the Coprocessor Share Signing key or the Sender key. The Coprocessor that will receive the master key is referred to as either the master-key-share target node or the Receiver. The Receiver must also generate a retained RSA key pair and must also have been marked as suitable for use with cloning. This key is known as either the Coprocessor Share Receiving key or simply the Receiver key.

Both the Sender and Receiver public keys must be digitally signed or certified by a retained private key in a Coprocessor, referred to as the public key certifying node or the Certifier. This retained private key is the Certifier key. It is also referred to as the Share Administration key. The associated public key must be registered in both the Sender and the Receiver before shares can be generated and received. A Cryptographic Coprocessor can take on the role of Certifier only, or can it be both Certifier and Sender, or it can be both Certifier and Receiver.

As each share is generated it is signed by the Coprocessor using the Sender private key and encrypted by a newly generated triple DES key. The triple DES key is then wrapped or encrypted by the Receiver public key.

As each share is received, the signature on the share is verified using the Sender public key, the triple DES key is unwrapped or decrypted using the Receiver private key, and the share decrypted using the triple DES key. When m number of shares have been received, the cloned master key will be complete within the new master key register of the Receiver.

The easiest and fastest way to clone master keys is to use the Cryptographic Coprocessor configuration web-based utility. The utility includes the Master key cloning advisor. To start the master key cloning advisor, follow these steps:

If you would prefer to write your own application to clone master keys, you can do so by using the following API verbs:

• Cryptographic_Facility_Control (CSUACFC)
• PKA_Key_Token_Build (CSNDPKB) (may not be needed depending upon how you write your application)
• PKA_Key_Generate (CSNDPKG)
• PKA_Public_Key_Register (CSNDPKR)
• One_Way_Hash (CSNBOWH)
• Digital_Signature_Generate (CSNDDSG)
• Master_Key_Distribution (CSUAMKD)