Imprint and compliant mode were added to indirectly and directly meet the PCI-HSM PIN Transaction Security v3.0, 2016 requirement. TKE is required to manage Host Crypto Module domains in imprint and compliant mode. 

GLYPH<SM590000> Set clock 

With TKE 9.0, the host crypto module’s cloc k can be set. The clock must be set before a domain can be placed in imprint mode. 

GLYPH<SM590000> Domain-specific Host Crypto Module Audit Log management 

Domains in imprint mode or compliant mode on a Crypto Express6S maintain a domain-specific module audit log. The TKE provides a feature for downloading the audit records so they can be viewed. 

GLYPH<SM590000> Domain-specific roles and authorities 

Domains in imprint mode or compliant mode on a Crypto Express6S must be managed by using domain-specific roles and authorities. The TKE provides new management features for the domain-specific roles and authorities. The roles are subject to forced dual control policies that prevent roles from issuing and co-signing a command. For information about how to manage imprint and compliant mode domains, see the TKE User’s Guide. 

GLYPH<SM590000> Setup PCI Environment Wizard 

To simplify the management of a compliant domain, the TKE provides a setup wizard that creates a minimum set of forced dual control roles and authorities that are needed to manage a compliant domain. For more information about how to manage imprint and compliant mode domains, see the TKE User’s Guide. 

## 6.6.1 Logical partition, TKE host, and TKE target 

Tip:  For more information about handling a TKE, see the TKE Introduction video. 

If one or more LPARs are configured to use Crypto Express coprocessors, the TKE workstation can be used to manage DES, AES, ECC, and PKA master keys. This management can be done for all cryptographic domains of each Crypto Express coprocessor feature that is assigned to the LPARs that are defined to the TKE workstation. 

Each LPAR in the same system that uses a domain that is managed through a TKE workstation connection is a TKE host or TKE target. An LPAR with a TCP/IP connection to the TKE is referred to as the TKE host ; all other partitions are TKE targets . 

The cryptographic controls that are set for an LPAR through the SE determine whether the workstation is a TKE host or a TKE target. 

## 6.6.2 Optional smart card reader 

An optional smart card reader (FC 0895) can be added to the TKE workstation. One FC 0895 includes two smart card readers, two cables to connect them to the TKE workstation, and 20 smart cards. The reader supports the use of smart cards that contain an embedded microprocessor and associated memory for data storage. The memory can contain the keys to be loaded into the Crypto Express features. These readers can be used with smart cards only that have applets that were loaded from a TKE 8.1 or later. These cards are FIPS certified. 

