Abstract: Aspects of the invention include channel key loading of a host bus adapter (HBA) based on a secure key exchange (SKE) authentication response by a responder node of a computing environment. A non-limiting example computer-implemented method includes receiving an authentication response message at an initiator channel on an initiator node from a responder channel on a responder node to establish a secure communication, the receiving at a local key manager (LKM) executing on the initiator node. A state check can be performed based on a security association of the initiator node and the responder node. An identifier of a selected encryption algorithm can be extracted from the authentication response message. The initiator channel can request to communicate with the responder channel based at least in part on a successful state check and the selected encryption algorithm.

Abstract: Aspects of the invention include initializing a local key manager (LKM) on a node of a computing environment. The node includes a plurality of channels. The LKM is configured to provide a secure data transfer between the node and an other node of the computing environment. A connection is established, by the LKM, between the LKM and an external key manager (EKM) that stores a shared key for the node and the other node. In response to establishing the connection, the LKM registers security capabilities of the plurality of channels. The security capabilities are used by the LKM to provide the secure data transfer between the node and the other node.

Abstract: Aspects of the invention include receiving a request from an initiator channel on an initiator node to initiate a secure communication with a responder channel on a responder node. The receiving is at a local key manager (LKM) executing on the initiator node. A security association is created at the LKM between the initiator node and the responder node. An identifier of a shared key assigned for communication between the initiator node and the responder node is obtained, and a message requesting initialization of the secure communication between the initiator channel and the responder channel is built. The message includes the identifier of the shared key. The message is sent to the initiator channel.

Abstract: Aspects of the invention include detecting that a rekey timer has expired. The rekey timer is one of a shared key rekey timer for a current shared key between the first node and a second node, and a session key rekey timer for a session key used in a secure communication between a channel on the first node and a channel on the second node. The session key was created based on the current shared key and is used for encrypting data in the secure communication. Based on the rekey timer being the shared key rekey timer, a new shared key is obtained and stored as the current shared key. Based on the rekey timer being the session key rekey timer, a new session key that is based at least in part on the current shared key is obtained and used in the secure communication.

Abstract: Aspects of the invention include receiving a request from a responder channel on a responder node to initiate a secure communication with an initiator channel on an initiator node. The request includes an identifier of a shared key, and a nonce and security parameter index generated by the initiator node for the secure communication. The receiving is at a local key manager (LKM) executing on the responder node. A security association is created at the LKM between the initiator node and the responder node. The shared key is obtained based at least in part on the identifier of the shared key. Based on obtaining the shared key, a message requesting initialization of the secure communication between the responder channel and the initiator channel is built. The message includes an initiator nonce and an initiator security parameter index generated by the LKM for the secure communication.

Abstract: Aspects of the invention include generation of a secure key exchange (SKE) authentication response by a responder node of a computing environment. A computer-implemented method includes receiving an authentication request message at a responder channel on the responder node from an initiator channel on an initiator node to establish a secure communication, the receiving at a local key manager (LKM) executing on the responder node. A state check is performed based on a security association of the initiator node and the responder node. A validation of the authentication request message is performed. A proposal list of the authentication request message is checked. An authentication response message is built based at least in part on a successful state check, a successful validation, and selecting an encryption algorithm from the proposal list. The authentication response message is sent from the LKM to the responder channel.

Abstract: Aspects of the invention include generation of a secure key exchange (SKE) authentication request by an initiator node of a computing environment. A non-limiting example computer-implemented method includes receiving an initialization response message at an initiator channel on an initiator node from a responder channel on a responder node to initiate a secure communication, the receiving at a local key manager (LKM) executing on the initiator node. A set of cryptographic keys is derived based on a security association payload of the initialization response message. A proposal list is built based on one or more security capabilities supported by the initiator channel. An authentication request message is built based at least in part on the set of cryptographic keys and the proposal list. The authentication request message is sent from the LKM to the initiator channel.

Abstract: Aspects of the invention include channel key loading of a host bus adapter (HBA) based on a secure key exchange (SKE) authentication response by a responder node of a computing environment. A non-limiting example computer-implemented method includes receiving an authentication response message at an initiator channel on an initiator node from a responder channel on a responder node to establish a secure communication, the receiving at a local key manager (LKM) executing on the initiator node. A state check can be performed based on a security association of the initiator node and the responder node. An identifier of a selected encryption algorithm can be extracted from the authentication response message. The initiator channel can request to communicate with the responder channel based at least in part on a successful state check and the selected encryption algorithm.

Abstract: Provided are a computer program product, system and method embodiments for secure communication between an initiator and a responder over a network. The responder receives, from the initiator, a security association initialization message to establish a security association with the responder including key material used to generate a key for the security association. The responder receives an authentication message from the initiator to program the responder to establish authentication between the responder and the initiator after establishing the security association. The responder sends an authentication message response to the initiator to establish authentication with the responder in response to the authentication message. The responder sends an authentication done message to the initiator after sending the authentication message response to cause the initiator to activate using the security association and the key to encrypt and decrypt communication between the responder and initiator.

Abstract: Provided are a computer program product, system and method embodiments for secure communication between an initiator and a responder over a network. The initiator sends a security association initialization message to the responder to establish a security association including key material used to generate a key for the security association. In response to receiving a security association initialization response to accept the security association, the initiator sends an authentication message to the responder to establish authentication between the responder and the initiator. In response to receiving an authentication message response to the authentication message, the initiator is programmed with the security association. An authentication done message is received from the responder after receiving the authentication message response.

Abstract: Aspects of the invention include receiving an error code describing a computer hardware or firmware error. A list of data items to be collected to assist in correcting the error is received. The contents of the list are selected based at least in part on the error code and are in priority order. The data items in the list are collected and a buffer to store the collected data items is selected. At least a subset of the collected data items to be written is transmitted to the buffer. All of the collected data items are transmitted to the buffer when the buffer is large enough to hold all of the data items in the list. A subset of the collected data items are transmitted to the buffer in priority order when the buffer is not large enough to hold all of the data in the list.

Abstract: Aspects of the invention include channel key loading of a host bus adapter (HBA) based on a secure key exchange (SKE) authentication response by a responder node of a computing environment. A non-limiting example computer-implemented method includes receiving an authentication response message at an initiator channel on an initiator node from a responder channel on a responder node to establish a secure communication, the receiving at a local key manager (LKM) executing on the initiator node. A state check is performed based on a security association of the initiator node and the responder node. A validation of the authentication response message is performed. An identifier of a selected encryption algorithm is extracted from the authentication response message. The initiator channel requests to communicate with the responder channel based at least in part on a successful state check, a successful validation, and the selected encryption algorithm.

Abstract: Aspects of the invention include receiving a request from a responder channel on a responder node to initiate a secure communication with an initiator channel on an initiator node. The request includes an identifier of a shared key, and a nonce and security parameter index generated by the initiator node for the secure communication. The receiving is at a local key manager (LKM) executing on the responder node. A security association is created at the LKM between the initiator node and the responder node. The shared key is obtained based at least in part on the identifier of the shared key. Based on obtaining the shared key, a message requesting initialization of the secure communication between the responder channel and the initiator channel is built. The message includes an initiator nonce and an initiator security parameter index generated by the LKM for the secure communication.

Abstract: Aspects of the invention include generation of a secure key exchange (SKE) authentication response by a responder node of a computing environment. A computer-implemented method includes receiving an authentication request message at a responder channel on the responder node from an initiator channel on an initiator node to establish a secure communication, the receiving at a local key manager (LKM) executing on the responder node. A state check is performed based on a security association of the initiator node and the responder node. A validation of the authentication request message is performed. A proposal list of the authentication request message is checked. An authentication response message is built based at least in part on a successful state check, a successful validation, and selecting an encryption algorithm from the proposal list. The authentication response message is sent from the LKM to the responder channel.

Abstract: Aspects of the invention include receiving a request from an initiator channel on an initiator node to initiate a secure communication with a responder channel on a responder node. The receiving is at a local key manager (LKM) executing on the initiator node. A security association is created at the LKM between the initiator node and the responder node. An identifier of a shared key assigned for communication between the initiator node and the responder node is obtained, and a message requesting initialization of the secure communication between the initiator channel and the responder channel is built. The message includes the identifier of the shared key. The message is sent to the initiator channel.

Abstract: Aspects of the invention include initializing a local key manager (LKM) on a node of a computing environment. The node includes a plurality of channels. The LKM is configured to provide a secure data transfer between the node and an other node of the computing environment. A connection is established, by the LKM, between the LKM and an external key manager (EKM) that stores a shared key for the node and the other node. In response to establishing the connection, the LKM registers security capabilities of the plurality of channels. The security capabilities are used by the LKM to provide the secure data transfer between the node and the other node.

Abstract: Aspects of the invention include channel key loading of a host bus adapter (HBA) based on a secure key exchange (SKE) authentication response by a responder node of a computing environment. A non-limiting example computer-implemented method includes receiving an authentication response message at an initiator channel on an initiator node from a responder channel on a responder node to establish a secure communication, the receiving at a local key manager (LKM) executing on the initiator node. A state check is performed based on a security association of the initiator node and the responder node. A validation of the authentication response message is performed. An identifier of a selected encryption algorithm is extracted from the authentication response message. The initiator channel requests to communicate with the responder channel based at least in part on a successful state check, a successful validation, and the selected encryption algorithm.

Abstract: Aspects of the invention include generation of a secure key exchange (SKE) authentication request by an initiator node of a computing environment. A non-limiting example computer-implemented method includes receiving an initialization response message at an initiator channel on an initiator node from a responder channel on a responder node to initiate a secure communication, the receiving at a local key manager (LKM) executing on the initiator node. A set of cryptographic keys is derived based on a security association payload of the initialization response message. A proposal list is built based on one or more security capabilities supported by the initiator channel. An authentication request message is built based at least in part on the set of cryptographic keys and the proposal list. The authentication request message is sent from the LKM to the initiator channel.

Abstract: Aspects of the invention include detecting that a rekey timer has expired. The rekey timer is one of a shared key rekey timer for a current shared key between the first node and a second node, and a session key rekey timer for a session key used in a secure communication between a channel on the first node and a channel on the second node. The session key was created based on the current shared key and is used for encrypting data in the secure communication. Based on the rekey timer being the shared key rekey timer, a new shared key is obtained and stored as the current shared key. Based on the rekey timer being the session key rekey timer, a new session key that is based at least in part on the current shared key is obtained and used in the secure communication.

Abstract: Aspects of the invention include receiving an error code describing a computer hardware or firmware error. A list of data items to be collected to assist in correcting the error is received. The contents of the list are selected based at least in part on the error code and are in priority order. The data items in the list are collected and a buffer to store the collected data items is selected. At least a subset of the collected data items to be written is transmitted to the buffer. All of the collected data items are transmitted to the buffer when the buffer is large enough to hold all of the data items in the list. A subset of the collected data items are transmitted to the buffer in priority order when the buffer is not large enough to hold all of the data in the list.