IBM Z Simplification

IBM Z Simplification

IBM Z Simplification

Transforming IBM Z into an simpler, more intuitive platform so every user, from beginners to experts, can learn faster, work confidently, and drive meaningful outcomes.

 View Only

  • 1.  Security Deprecations

    Posted 04/06/26 07:46 PM
    Edited by Sneha Kanaujia Fisher 07/28/26 09:44 AM
    Added 2026-05-27:

    IRRPRMxx BUFFERS Parameter Simplification

    What is being removed or changed

    In a future z/OS release following z/OS 3.2, the IRRPRMxx parmlib option BUFFERS(nnn) will no longer be configurable. RACF will always use a fixed value of 255 buffers, regardless of what is specified in IRRPRMxx or in the RACF data set names table (ICHRDSNT). No message will be issued when this occurs.

    Required customer migration or upgrade actions

    Review IRRPRMxx parmlib members for any use of the BUFFERS parameter. Plan to remove the BUFFERS(nnn) specification once all systems in the environment are running on the updated release. Verify that the small increase in ECSA storage from using 255 buffers is acceptable.

    This change will be made the next release of z/OS. More information can be made available by requesting in thread below.

    Why is IBM making this change?

    RACF already defaults to using the maximum buffer value in most environments. Standardizing on a fixed value of 255 removes an unnecessary tuning parameter and simplifies RACF configuration and administration.

    Links to the relevant documentation

    IRRPRMxx parmlib parameter syntax

    Added 2026-04-29:

    Changes to OpenSSH for z/OS

    What is being removed or changed

    The next deliverable of OpenSSH for z/OS that introduces a new release of OpenSSH, is planned to support multiple Post Quantum Cryptography (PQC) algorithms, while permanently removing support for weak Digital Signature Algorithm (DSA). Specifically, OpenSSH for z/OS is being updated to provide currency and support PQC key exchange using a hybrid scheme, while removing support for the ssh-dss host key algorithm. These changes align with changes made by the OpenSSH open source community.

    Why is IBM making this change?

    IBM is aligning OpenSSH for z/OS with the OpenSSH open source community by removing weak DSA algorithms and introducing support for post-quantum cryptography. This strengthens security and prepares for future cryptographic requirements.

    Links to the relevant documentation

    z/OS Statement of Direction AD26-0431

    Added 2026-04-06:

    Removal of Support for Deprecated CMS and SSL APIs; SSLv2 and SSLv3 Protocols

    What is being removed or changed

    z/OS 3.2 is planned to be the last release to support:

    •            Deprecated CMS APIs
    •            Deprecated SSL APIs
    •            SSLv2 and SSLv3 protocols

    These protocols and APIs have been deprecated by industry standards bodies and are no longer considered secure.

    Required customer migration or upgrade actions

    Customers must:

    •             Identify applications using deprecated CMS or SSL APIs
    •            Migrate applications to supported cryptographic APIs
    •            Update System SSL and AT‑TLS configurations to use modern TLS protocols

    Failure to update may prevent applications from running on releases beyond z/OS 3.2.

    Why is IBM making this change?

    These APIs and protocols are based on obsolete security technologies that no longer meet modern security expectations. Their removal improves security and aligns z/OS with current industry standards.

    Links to the relevant documentation

    z/OS 3.2 Announcement - Statement of Direction AD26-0005

    z/OS Cryptographic Services documentation



Related Content