Hello,

How are you? I hope you 're very well. Now I 've a problem which states that ( If I have 3 systems in sysplex , system A, B and system C. If I configured system A and System B to have the same master key and the same CKDS, PKDS AND TKDS. System C uses the different master key and the different CKDS, PKDS AND TKDS. Now I modified in the procedure of csf in System C to take the same CKDS, PKDS AND TKDS of System A and B, but the master key still different and I want to make the master key in C is the same of A and B without changing the master key on System A,B).

Best Regards,

Ahmed Talaat

You should be able to load the same MKs on System C as the new master keys and then either restart ICSF on System C (which will automatically promote) or perform a Set MK.

Hello,

Can you guide me to how to load mk on System C from A through a way either than TKE?

Best Regards,

All of what I'm summarizing is described in the ICSF Administrator's Guide, Chapter 8 (https://www.ibm.com/docs/en/zos/3.1.0?topic=keys-entering-master-key-parts)

From the main ICSF panel (CSF@PRIM), option 1 is the Coprocessor Management panel.

On that panel (https://www.ibm.com/docs/en/zos/3.1.0?topic=panels-csfcmp00-coprocessor-management-panel), option E next to all the cards, then enter the MK type (AES or DES for the CKDS), the part is FIRST, then enter the same MK part used on A and B. Repeat with zero or more MIDDLE and the FINAL part(s) would would be the same as used on A and B). Once both the AES and DES new MKs are in FULL state, you can use the Set MK option to make them current since they will now match the CKDS.

------------------------------
Eric Rossman
------------------------------

If you do not know the current MKs on A and B, your only options are either:

1. Use a TKE
2. Load new AES and DES MKs on A and B, reencipher the CKDS (or coordinated change master key), then load those same new MKs on system C following my other instructions.