Defining Security Protection Profiles in CA Top Secret › Key Protection Profiles for CA Top Secret › PERMIT Command for Defining Key Permission for CA Top Secret

PERMIT Command for Defining Key Permission for CA Top Secret

Use the PERMIT command to define permissions for a specific key and one or more specific users on a specified subsystem for CA Top Secret. Use this command with an associated ADDTO command for the key.

This command has the following format:

TSS PERMIT(acidname) CA@BES(BESn.key_type.key_name) ACCESS(READ)

TSS

Indicates a CA Top Secret command.

PERMIT

Indicates the PERMIT command.

acidname

Specifies the accessor ID.

CA@BES

Specifies the general resource class for CA Tape Encryption. For keys, this is always CA@BES.

n

Indicates the BES task number. If you specify BES with no subsystem identifier, the profile applies to all BES subsystems.

key_type

Indicates the type of key to define. Options for this parameter are as follows:

KEYCODE

Specifies a code book.

KEYCERT

Specifies a digital certificate key pair.

KEYSYMM

Specifies a symmetric key.

key_name

Specifies the name of the key.

ACCESS

Specifies the permission access granted. This value is always READ. It allows the specified user to use the key.

Example: Permit a user to access a key on a specific subsystem

This example defines permission for user SECADMIN to use a symmetric key named AES256_KEY on BES4.

TSS PERMIT(SECADMIN) CA@BES(BES4.KEYSYMM.AES256_KEY) ACCESS(READ)