IBM Crypto Education Community

IBM Crypto Education Community

IBM Crypto Education Community

Join the IBM Crypto Education community to explore and understand IBM cryptography technology. This community is operated and maintained by the IBM Crypto Development team.

 View Only
  • 1.  Clear current master key

    Posted Tue July 05, 2022 08:47 AM
    Hi,

    I have AES and DES master keys defined along with a CKDS with operational keys.
    Now i don't need DES master key anymore.
    How can i clear DES master key ?
    Do I have to start with a fresh CKDS and activate AES master key again ?
    What about the existing operational keys AES encrypted currently in the CKDS ?
    obs. i also use a TKE.

    Thank you your help.

    Fernando

    ------------------------------
    Fernando Pedro Neves
    ------------------------------


  • 2.  RE: Clear current master key

    Posted Tue July 05, 2022 01:48 PM
    In HCR77D2 (V2R5), we shipped a sample CSFMKVPR which does exactly what you are asking for.

    Notes:
    1. Please make sure to keep a backup of the KDS before the operation for safe keeping.
    2. The sample works on sequential files (IDCAMS REPRO of the CKDS or PKDS) to avoid manipulating a VSAM file directly.
    3. The sample will refuse to remove an MKVP if there are any tokens that depend on that master key present. We will list the key labels which prevent the operation in the job output.

    ------------------------------
    Eric Rossman
    ------------------------------



  • 3.  RE: Clear current master key

    Posted Tue July 05, 2022 06:28 PM
    Hi Eric,

    Thank you for your help.
    Looks like I'm out of luck.
    Unfortunately I'm with HCR77C0 (v2R3) and HCR77D0 (v2r4) systems.
    Is there any other way?

    Thanks

    ------------------------------
    Fernando Pedro Neves
    ------------------------------



  • 4.  RE: Clear current master key

    Posted Tue July 05, 2022 10:25 PM
      |   view attached
    Good news: I don't think you are out of luck. There is nothing unique to HCR77D2 in the sample, so it should work on older releases. As always, it is "AS-IS" but I cannot see any reason it wouldn't work.

    ------------------------------
    Eric Rossman
    ------------------------------

    Attachment(s)

    txt
    csfmkvpr.txt   73 KB 1 version