RE: Crypto APIs

It is easier to call a MI program than even find this.  We have the crypt
cards, but I can tell you doing it ourselves with MI is a lot easier. 

Just setting up the beast was harder than making or calling a MI program.
Now if I lost the keys that set it up, I am hosed.  Have you seen how many
keys there is?  

Again, you have taken something so simple and turned it into reading half of
the library of congress, then working it. If you can stay awake.  Have you
looked to see how it is done in Java, Microsoft, Atalla, or Jones Futurex?

My father always said one thing.  K.I.S.S. Keep it simple stupid, come out
behind the desk and talk to the real users.  Why is TCPIP world wide
standard but SNA is not.  Is TCPIP better.  Heck no, it is easier to
implement, and test.  A whole lot easier.  A 1000 times easier. 

Out here in the real world, we want to concentrate on a business
application, and getting it running.  Not trying to stay awake reading
volumes of materials. 

The des through mi is done with one simple call.  No setup, the program is
already written.  In RPG, I CALL DES PARMs(xxx xxxxx xxx xx ). Now in one
sentence of under 100 words or less, how do you setup and call des from the
finance package, who most people do not have? 

This is why you are getting your butt beat by Microsoft.  You have a hell of
a better system, they make it easier for developers, you torture us.  But we
are loyal, but dwindling.  We have bosses, and projects demanding to be
finished in records time.  

Let's take the finance package.  Where is it listed in marketing? How long
does it take to get?  If you can get the order department to find this, the
next thing is order it.  Wow, now you have eaten up about a month.  You get
it, and call help support.  Have you tried to call help support for finance,
or the crypt card.  Man, that is deer in headlights if I have ever seen it.
Getting past the call screener is difficult at beat.  Now down load the read
book.  Oops, too bad,  It has been over 6 weeks, and the customer was lost,
and you are fired.  I went that route, the bridge is out, the train is
broken and the track is missing.  It don't work, we have to make solutions
work. 

Now, we have MI, so call the MI routines and you have des, and you can move
on to other things.  Out here is the real world we compete with others that
have the same things. IBM 400 is one of a kind. You have very loyal fans
that are dropping like flies.  Look at the sales, you know this.

In this case, I could not get help, so we dropped to MI to get it done. We
had that choice, or we could have gone to Microsoft.  I chose MI.  But how
many people can do that? 

Please start listing to the customer, and give the tools to beat Microsoft's
butt, please don't repeat the age old marketing statements we have been
given.   We are in a battle to survive for our companies, we need the modern
weapons. We do not need to create them in the field, or worse wait for
marketing or help support come through. On these specially items, such as
finance or the crypt card, I can buy a Sun system, install it, and have it
running before I have the specially programs running.  

Now which way am I suppose to go? 

The answers you gave, we have been there and done that. I have the T shirt
to prove it.  And it is black. 

Harry 

For me take away of some access, and we will be forced to other platforms,
just because we cannot deal with IBM bureaucracy.  You know right now, if we
have a problem, there is no managers listed.  Call the operator, and ask for
Palamaro's number.  I know who is he.  Ask for the regional manager, oops,
they are not listed either.  But we get a task force which does not call us
back.  Oh yea, it has only been 2 months, we have to be patient for the
return call. KEEP US IN THE MAINSTREAM OF RPODUCTS. 

Earth to IBM.  Listen to the customer or we will revolt with our $$$$$. 

Give us the tools to create new applications fast, or get out of our way.  

Lead me, Follow me, or get the hell out of the way. 

   

  


-----Original Message-----
From: mi400-bounces@xxxxxxxxxxxx [mailto:mi400-bounces@xxxxxxxxxxxx] On
Behalf Of Beth Hagemeister
Sent: Wednesday, March 09, 2005 12:57 PM
To: MI400@xxxxxxxxxxxx
Subject: [MI400] Crypto APIs

The following paragraph was written in response to Bruce Vining's post - 
"Attention Users of *SYSTEM state", and I would like to address it.

"One of the most effective things we have done is access the crypt 
function. We can do DES and 3DES, Industry standards for over 30 years. 
Where are those API's. Oops, you forgot them. There are in MI. Where are 
they located beside MI?  In fact IBM invented DES in 1968, I think. It is 
in the MI instructions to access, but where is the API.  It has been a 
banking industry standard for over 35 years.  Where is the API? But yes 
you have to make the operating system more secure. "

Product CR1 has been available on AS/400 since Release 1.2.  CR1 provided 
APIs for DES encrypt/decrypt/MAC, simple PIN processing, and key 
management.  This product was originally designed to be functionally 
equivalent with the Cryptographic Facilities of the IBM 4700 Finance 
Controller.  Over the years, many of our banking customers used the CR1 
APIs. 

However, industry standards have changed dramatically since CR1 was 
developed.  To meet the needs of higher security demands, for several 
years we moved our cryptographic development efforts to hardware 
encryption - first with the IBM 2620 Cryptographic Coprocessor and then 
the IBM 4758 Cryptographic Coprocessor, both of which supported a full set 
of cryptographic APIs.  In V5R1, we moved some of our effort back to 
software crypto enhancements by developing a cryptographically secure 
pseudorandom number generator with APIs, and also implementing some of the 
newer encryption algorithms and making them available through the CIPHER 
MI instruction.  In V5R2 we implemented an infrastructure within SLIC that 
would provide a common interface (within SLIC) for accessing all our 
various cryptographic providers.  And in V5R3 we then implemented a set of 
cryptographic APIs on top of that infrastructure.  These APIs provide 
encryption/decryption, authentication, and key generation, either using 
OS/400 cryptographic function or using the 2058 Cryptographic Accelerator. 
 A subset of these APIs were PTF'd back into V5R2.  In a future release 
you can expect key management APIs.  To read more about these APIs, visit 
the Info Center at 
http://publib.boulder.ibm.com/infocenter/iseries/v5r3/ic2924/info/apis/catcr
ypt.htm
.

Beth Hagemeister
iSeries Cryptographic Services
_______________________________________________
This is the MI Programming on the AS400 / iSeries (MI400) mailing list
To post a message email: MI400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/mi400
or email: MI400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/mi400.