i have a question regarding the new support introduced in z/OS 3.1 allowing to define HMAC clear keys.  Does it mean that we can also now define enhanced passtickets using HMAC clear keys now and that a CCA coprocessor is no longer a hard requirement ? Or do we still need to define HMAC keys encrypted with the AES master key ?

thank you, Philippe

I spoke to RACF and they said that it doesn't matter whether the key is clear or encrypted. The ICSF call that they use is also OK with either clear or encrypted keys.