IBM Crypto Education Community

IBM Crypto Education Community

IBM Crypto Education Community

Join the IBM Crypto Education community to explore and understand IBM cryptography technology. This community is operated and maintained by the IBM Crypto Development team.

 View Only

  • 1.  Adding a key for data set encryption using TRANSKEY

    Posted 08/16/21 09:29 AM
    Im trying to set up a key for data set encryption using KGUP.

    //S2 EXEC PGM=CSFKGUP
    //CSFCKDS DD DISP=OLD,DSN=CSF.SCSFCKDS
    //CSFDIAG DD SYSOUT=*,LRECL=133 (THE LRECL PARAMETERS ARE REQUIRED)
    //CSFKEYS DD SYSOUT=*,LRECL=1044
    //CSFSTMNT DD SYSOUT=*,LRECL=80
    //CSFIN DD *
    ADD TYPE(DATA) ALGORITHM(AES) LABEL(AES) LENGTH(32),
    TRANSKEY(ATOBAES)
    /*

    This gives me

    >>>CSFG0814 KEYWORD TRANSKEY NOT VALID WITH ALGORITHM AES.

    But the doc says

    TRANSKEY (key-label1[,key-label2])
    This keyword identifes the label of a transport key that already exists in the CKDS. KGUP uses the
    transport key either to decrypt an imported key value or to encrypt a key value to send to another
    system. The algorithm of the transport key must match the key being wrapped, that is, an AES key
    must be wrapped with an AES transport key.

    My ATOBAES has
    Key Attributes
    Algorithm: AES Key type: EXPORTER
    Length (bits): - Key check value: BB73A7 ENC-ZERO
    Key Usage: EXPORT TRANSLAT GEN-OPEX GEN-IMEX GEN-EXEX GEN-PUB WR-DES
    WR-AES WR-HMAC WR-DATA WR-KEK WR-PIN WRDERIVE WR-CARD


    Key Management: XPRT-SYM XPRTUASY XPRTAASY NOEX-RAW NOCMPTAG XPRT-DES
    XPRT-AES XPRT-RSA POCLRKV PCCLVAL
    Key Name:

    How should I do it?

    Colin

    ------------------------------
    Colin Paice
    ------------------------------


  • 2.  RE: Adding a key for data set encryption using TRANSKEY

    Posted 08/16/21 04:25 PM
    That message isn't as clear as it could be. An AES DATA key cannot be wrapped by an AES EXPORTER. It would have to be an AES CIPHER key. However, there is another issue if you wanted to use AES CIPHER keys. Currently, KGUP doesn't have the ability to create an AES CIPHER key with ANY-MODE encryption mode (key-usage field 2, high order byte), which is required for data set encryption using AES CIPHER keys.

    Can you describe your basic environment (two LPARs or more than two? What release of z/OS and ICSF on each LPAR? Same or different AES MKs? If same MK, are they sharing a CKDS or not sharing?) so that I can try to help you come up with a solution that will work for you?

    ------------------------------
    Eric Rossman
    ------------------------------



  • 3.  RE: Adding a key for data set encryption using TRANSKEY

    Posted 08/16/21 05:03 PM

    Hi

     

    I know ICSF option (5.5.7) Generate AES DATA Keys was set up to allow keys to be created for dataset encryption.   Sometime in the not too distant past the recommendation was changed to use AES CIPHER keys. 

     

    I don't know if ICSF will add an option to generate an AES CIPHER key or if there is a new recommendation. 

     

    Dan

     

    Dan W Little | Senior Director, Mainframe Operating Systems | RBC | T. 416-348-4502 | C. 647-271-7485

    Toronto, Ontario M5V 3K7

     

     

    _______________________________________________________________________

    If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference.

    Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future.




    Original Message


  • 4.  RE: Adding a key for data set encryption using TRANSKEY

    Posted 08/17/21 09:02 AM
    Edited by Eric Rossman 08/17/21 10:16 AM
    Dan, I don't have the RFE handy, but that requirement (make a utility capable of producing an AES CIPHER key capable of being used in data set encryption) has been recognized. While IBM never promises to deliver any particular functionality on any specific timeline (if at all), we are looking at this right now. I would love to give a time frame, but I cannot.

    That said, in the updated draft of the data set encryption red book (https://www.redbooks.ibm.com/Redbooks.nsf/RedpieceAbstracts/sg248410.html?Open), we've updated quite a bit.
    • Appendix B has sample REXX execs which would invoke the same services that KGUP (for example) would use (if it were capable of AES CIPHER to be used for data set encryption right now)
    • Section 9.2 "Transporting data set encryption keys" talks about how to transport the keys between systems.
    I'm hoping that this helps.

    ------------------------------
    Eric Rossman
    ------------------------------

    Original Message


  • 5.  RE: Adding a key for data set encryption using TRANSKEY

    Posted 08/17/21 10:20 AM
    Hi Eric,

    Thanks for your comments.  Having the rexx in the document is not easy to use, as when I cut and paste it, multiple blanks are removed, so there is no indentation and
    'INTERNALAES     CIPHER  XPRTCPACANY-MODE'
    comes out as
    'INTERNALAES CIPHER XPRTCPACANY-MODE with one blank after the AES not the 5 that the original has.

    Im working on some C utilities for ICSF, which I may put up on github, for example batch job to list PKDS, and CKDS.

    Colin

    One of the problems I have is that it is hard to tell what is supported/allowed and what is not.  Ive raised many doc comments through MHVRCFS@us.ibm.com

    ------------------------------
    Colin Paice
    ------------------------------

    Original Message


  • 6.  RE: Adding a key for data set encryption using TRANSKEY

    Posted 08/17/21 10:54 AM
    That's unfortunate about the samples. I'm attaching the samples as they should have been (I'm the current maintainer of them). It forces me to upload as .txt but they are plain-text (no markup), so you should be able to pull them direction.

    As for doc comments, they are normally handled pretty effectively. Feel free to email me some that haven't been addressed and I will see what happened (if I can) or at least try to get the next release of publications updated (we can no longer refresh HCR77D1 and earlier books unless it is critical).

    ------------------------------
    Eric Rossman
    ------------------------------

    Attachment(s)

    txt
    GENKEYC.txt   11 KB 1 version
    txt
    GENKEY.txt   7 KB 1 version
    Original Message


  • 7.  RE: Adding a key for data set encryption using TRANSKEY

    Posted 08/17/21 12:31 PM

    Hi Eric,

    Thanks for the scripts - it worked perfectly, and I can now encrypt a dataset using a AES CIPHER.

    I'll work on getting this into a C program, so I can work on encrypting my dataset and sending it to a different system.

    Colin



    ------------------------------
    Colin Paice
    ------------------------------

    Original Message


  • 8.  RE: Adding a key for data set encryption using TRANSKEY

    Posted 08/17/21 10:04 AM
    Hi Dan,

    Thanks for your update.

    If I use
    ADD TYPE(CIPHER ) ALGORITHM(AES) LENGTH(32) LAB(AESCI)

    I get
    IEC143I 213-85,  RC=X'00000008',RSN=X'0000085E'
    85E (2142) The key usage attributes of the variable-length key token does not allow the requested operation. For example,
    the request might have been to encrypt data, but encryption is not allowed, or the request might have been to
    use the ECB cipher mode, but that mode is not allowed.
    User action: Use the variable-length key token in a manner consistent with its usage attributes or create a new
    key token with the desired attributes.

    I cant get CIPHER to work.

    Colin

    ------------------------------
    Colin Paice
    ------------------------------

    Original Message


Related Content