Patent ID: 8498418

Claim:
A computer program product for managing cryptographic keys of a computing environment, the computer program product comprising: a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising: converting an encrypted cryptographic key protected under one level of security to a re-encrypted cryptographic key protected under another level of security, the one level of security provided by a tamper resistant, high security device, and the another level of security including a trust boundary defined by policy, the another level of security having fewer security requirements than the one level of security and including one or more components of the computing environment, the converting comprising: based on a request by a user application to perform a cryptographic function, obtaining by a processor of the computing environment, the encrypted cryptographic key encrypted under the one level of security using a master key internal to the one level of security, the processor coupled to the tamper resistant, high security device; executing, by the processor, transparent to the user application, an enqueue adjunct processor queue (NQAP) instruction to re-encipher the encrypted cryptographic key, the NQAP instruction to provide the encrypted cryptographic key to be re-encrypted, decipher command to be performed, and an indicator indicating that the decipher command to be performed is a special command; based on executing the NQAP instruction, obtaining the encrypted cryptographic key in the clear as a clear key, the clear key placed in secure memory observable by the another level of security and not observable outside of the another level of security; and re-encrypting, by the processor, the clear key using a wrapping key kept inside the another level of security to provide an encrypted key to be used in the cryptographic function.