Conversion of cryptographic key protection

1. A computer program product for managing cryptographic keys of a computing environment, the computer program product comprising:

a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:

converting an encrypted cryptographic key protected under one level of security to a re-encrypted cryptographic key protected under another level of security, the one level of security provided by a tamper resistant, high security device, and the another level of security including a trust boundary defined by policy, the another level of security having fewer security requirements than the one level of security and including one or more components of the computing environment, the converting comprising:

based on a request by a user application to perform a cryptographic function, obtaining by a processor of the computing environment, the encrypted cryptographic key encrypted under the one level of security using a master key internal to the one level of security, the processor coupled to the tamper resistant, high security device;

executing, by the processor, transparent to the user application, an enqueue adjunct processor queue (NQAP) instruction to re-encipher the encrypted cryptographic key, the NQAP instruction to provide the encrypted cryptographic key to be re-encrypted, decipher command to be performed, and an indicator indicating that the decipher command to be performed is a special command;

based on executing the NQAP instruction, obtaining the encrypted cryptographic key in the clear as a clear key, the clear key placed in secure memory observable by the another level of security and not observable outside of the another level of security; and

re-encrypting, by the processor, the clear key using a wrapping key kept inside the another level of security to provide an encrypted key to be used in the cryptographic function.

2. The computer program product of claim 1 , wherein the method further comprises:

retrieving by the user application the encrypted key; and

using the encrypted key to perform the cryptographic function, wherein the using invokes a cryptographic assist device to perform the cryptographic function.

3. The computer program product of claim 1 , wherein the wrapping key has associated therewith a wrapping key verification pattern used in verifying validity of the encrypted key to be used in performing cryptographic functions.

4. The computer program product of claim 1 , wherein the clear key is only in a secure portion of a hardware system area.

5. The computer program product of claim 1 , wherein the tamper resistant, high security device comprises a cryptographic device coupled to the processor, and the method further comprises:

based on executing the NQAP instruction, sending the decipher command to the cryptographic device;

based on receiving the decipher command, decrypting by the cryptographic device the encrypted cryptographic key to produce the clear key; and

providing by the cryptographic device the clear key to the processor, wherein the clear key is secure within the another level of security.

6. The computer program product of claim 5 , wherein the providing the clear key places the clear key in a queue located in a hardware system area within the another level of security.

7. The computer program product of claim 6 , wherein the re-encrypting comprises:

determining whether it is appropriate to remove the clear key from the queue;

based on the determining indicating it is appropriate, removing the clear key from the queue; and

encrypting the clear key under the wrapping key kept inside the another level of security.

8. The computer program product of claim 1 ,

wherein the method further comprises:

based on executing the NQAP instruction, placing a message specified by the NQAP instruction that includes the decipher command and the encrypted cryptographic key to be re-enciphered on a queue in main memory;

based on determining the decipher command is a special command, transferring the message from the queue in main memory to secure storage; and

based on successful execution of one or more validity checks, sending the decipher command to the tamper resistant, high security device to decrypt the encrypted cryptographic key providing the clear key.

9. The computer program product of claim 1 , wherein the method further comprises providing bulk data symmetric key cryptographic operations, using the encrypted key under the another level of security, that meets a customer's security requirements.

10. A computer system for managing cryptographic keys of a computing environment, the computer system comprising:

a memory; and

a processor in communications with the memory, wherein the computer system is configured to perform a method, said method comprising:

converting an encrypted cryptographic key protected under one level of security to a re-encrypted cryptographic key protected under another level of security, the one level of security provided by a tamper resistant, high security device, and the another level of security including a trust boundary defined by policy, the another level of security having fewer security requirements than the one level of security and including one or more components of the computing environment, the converting comprising:

based on a request by a user application to perform a cryptographic function, obtaining by a processor of the computing environment, the encrypted cryptographic key encrypted under the one level of security using a master key internal to the one level of security, the processor coupled to the tamper resistant, high security device;

executing, by the processor, transparent to the user application, an enqueue adjunct processor queue (NQAP) instruction to re-encipher the encrypted cryptographic key, the NQAP instruction to provide the encrypted cryptographic key to be re-encrypted, a decipher command to be performed, and an indicator indicating that the decipher command to be performed is a special command;

based on executing the NQAP instruction, obtaining the encrypted cryptographic key in the clear as a clear key, the clear key placed in secure memory observable by the another level of security and not observable outside of the another level of security; and

re-encrypting, by the processor, the clear key using a wrapping key kept inside the another level of security to provide an encrypted key to be used in the cryptographic function.

11. The computer system of claim 10 , wherein the method further comprises:

retrieving by the user application the encrypted key; and

using the encrypted key to perform the cryptographic function, wherein the using invokes a cryptographic assist device to perform the cryptographic function.

12. The computer system of claim 10 , wherein the wrapping key has associated therewith a wrapping key verification pattern used in verifying validity of the encrypted key to be used in performing cryptographic functions.

13. The computer system of claim 10 , wherein the tamper resistant, high security device comprises a cryptographic device coupled to the processor, and the method further comprises:

based on executing the NQAP instruction, sending the decipher command to the cryptographic device;

based on receiving the decipher command, decrypting by the cryptographic device the encrypted cryptographic key to produce the clear key; and

providing by the cryptographic device the clear key to the processor, wherein the clear key is secure within the another level of security.

14. The computer system of claim 13 , wherein the providing the clear key places the clear key in a queue located in a hardware system area within the another level of security.

15. The computer system of claim 14 , wherein the re-encrypting comprises:

determining whether it is appropriate to remove the clear key from the queue;

based on the determining indicating it is appropriate, removing the clear key from the queue; and

encrypting the clear key under the wrapping key kept inside the another level of security.

16. The computer system of claim 10 ,

wherein the method further comprises:

based on executing the NQAP instruction, placing a message specified by the NQAP instruction that includes the decipher command and the encrypted cryptographic key to be re-enciphered on a queue in main memory;

based on determining the decipher command is a special command, transferring the message from the queue in main memory to secure storage; and

based on successful execution of one or more validity checks, sending the decipher command to the tamper resistant, high security device to decrypt the encrypted cryptographic key providing the clear key.

17. A method of managing cryptographic keys of a computing environment, the method comprising:

converting an encrypted cryptographic key protected under one level of security to a re-encrypted cryptographic key protected under another level of security, the one level of security provided by a tamper resistant, high security device, and the another level of security including a trust boundary defined by policy, the another level of security having fewer security requirements than the one level of security and including one or more components of the computing environment, the converting comprising:

based on a request by a user application to perform a cryptographic function, obtaining by a processor of the computing environment, the encrypted cryptographic key encrypted under the one level of security using a master key internal to the one level of security, the processor coupled to the tamper resistant, high security device;

executing, by the processor, transparent to the user application, an enqueue adjunct processor queue (NQAP) instruction to re-encipher the encrypted cryptographic key, the NQAP instruction to provide the encrypted cryptographic key to be re-encrypted, a decipher command to be performed, and an indicator indicating that the decipher command to be performed is a special command;

based on executing the NQAP instruction, obtaining the encrypted cryptographic key in the clear as a clear key, the clear key placed in secure memory observable by the another level of security and not observable outside of the another level of security; and

re-encrypting, by the processor, the clear key using a wrapping key kept inside the another level of security to provide an encrypted key to be used in the cryptographic function.

18. The method of claim 17 , wherein the tamper resistant, high security device comprises a cryptographic device coupled to the processor, and the method further comprises:

based on executing the NQAP instruction, sending the decipher command to the cryptographic device;

based on receiving the decipher command, decrypting by the cryptographic device the encrypted cryptographic key to produce the clear key; and

providing by the cryptographic device the clear key to the processor, wherein the clear key is secure within the another level of security.

19. The method of claim 18 , wherein the providing the clear key places the clear key in a queue located in a hardware system area within the another level of security, and wherein the re-encrypting comprises:

determining whether it is appropriate to remove the clear key from the queue;

based on the determining indicating it is appropriate, removing the clear key from the queue; and

encrypting the clear key under the wrapping key kept inside the another level of security.