Common Cryptographic Architecture (CCA)
IBM's API for cryptographic hardware, which decides which operations an HSM permits and how its keys may be used.
CCA is a programming interface and rule set that IBM built for its cryptographic cards, starting with the IBM 4758 and carried into its successors. Keys are tagged with control vectors, so a key meant for data encryption cannot be used to encrypt other keys, and the reverse.
The same idea reappears in later key block standards such as TR-31. Researchers have nonetheless shown that combinations of legitimate API calls can expose keys, a reminder that API design matters as much as the cipher underneath.