Hi,

I have AES and DES master keys defined along with a CKDS with operational keys.
Now i don't need DES master key anymore.
How can i clear DES master key ?
Do I have to start with a fresh CKDS and activate AES master key again ?
What about the existing operational keys AES encrypted currently in the CKDS ?
obs. i also use a TKE.

Thank you your help.

Fernando

------------------------------
Fernando Pedro Neves
------------------------------

In HCR77D2 (V2R5), we shipped a sample CSFMKVPR which does exactly what you are asking for.

Notes:
1. Please make sure to keep a backup of the KDS before the operation for safe keeping.
2. The sample works on sequential files (IDCAMS REPRO of the CKDS or PKDS) to avoid manipulating a VSAM file directly.
3. The sample will refuse to remove an MKVP if there are any tokens that depend on that master key present. We will list the key labels which prevent the operation in the job output.

------------------------------
Eric Rossman
------------------------------

Hi Eric,

Thank you for your help.
Looks like I'm out of luck.
Unfortunately I'm with HCR77C0 (v2R3) and HCR77D0 (v2r4) systems.
Is there any other way?

Thanks

------------------------------
Fernando Pedro Neves
------------------------------

Original Message:
Sent: Tue July 05, 2022 01:48 PM
From: Eric Rossman
Subject: Clear current master key

In HCR77D2 (V2R5), we shipped a sample CSFMKVPR which does exactly what you are asking for.

Notes:
1. Please make sure to keep a backup of the KDS before the operation for safe keeping.
2. The sample works on sequential files (IDCAMS REPRO of the CKDS or PKDS) to avoid manipulating a VSAM file directly.
3. The sample will refuse to remove an MKVP if there are any tokens that depend on that master key present. We will list the key labels which prevent the operation in the job output.

------------------------------
Eric Rossman
------------------------------

Good news: I don't think you are out of luck. There is nothing unique to HCR77D2 in the sample, so it should work on older releases. As always, it is "AS-IS" but I cannot see any reason it wouldn't work.

------------------------------
Eric Rossman
------------------------------

Original Message:
Sent: Tue July 05, 2022 06:27 PM
From: Fernando Pedro Neves
Subject: Clear current master key

Hi Eric,

Thank you for your help.
Looks like I'm out of luck.
Unfortunately I'm with HCR77C0 (v2R3) and HCR77D0 (v2r4) systems.
Is there any other way?

Thanks

------------------------------
Fernando Pedro Neves
------------------------------


Original Message:
Sent: Tue July 05, 2022 01:48 PM
From: Eric Rossman
Subject: Clear current master key

In HCR77D2 (V2R5), we shipped a sample CSFMKVPR which does exactly what you are asking for.

Notes:
1. Please make sure to keep a backup of the KDS before the operation for safe keeping.
2. The sample works on sequential files (IDCAMS REPRO of the CKDS or PKDS) to avoid manipulating a VSAM file directly.
3. The sample will refuse to remove an MKVP if there are any tokens that depend on that master key present. We will list the key labels which prevent the operation in the job output.

------------------------------
Eric Rossman