Does anyone know of any way to export a ICSF private key between PKDS with different PKA Master Key?

------------------------------
Renato Almeida de Brito
------------------------------

Once encrypted by a CCA master key, there is no way to export a CCA RSA private key.

If the key is clear or is wrapped by a transport key, it can be copied as-is.

------------------------------
Eric Rossman
------------------------------

As Eric said, you can't export the RSA private keys in the PKDS.

One tip / trick is that you could bring up another LPAR running ICSF with the old PKDS and old Master Key. Then do a Coordinated Change MK to rotate the keys in the old PKDS to a new PKDS with the new Master Key. Then you could just copy the RSA private key from the newly reenciphered PKDS to the target PKDS since the MKs are now the same.

------------------------------
Eysha Shirrine
------------------------------

week ago i faced with same problem. (migrate to new zr1)
the way to solve that problem:

1.alloctae new  CSFPKDS  CSFCKDS
2. define new master key
3. repro old csfpkds to new one.

work fine for me.

------------------------------
shimon yosef
------------------------------