IBM Crypto Education Community

IBM Crypto Education Community

IBM Crypto Education Community

Join the IBM Crypto Education community to explore and understand IBM cryptography technology. This community is operated and maintained by the IBM Crypto Development team.

 View Only
  • 1.  Setting a master key on a sysplex system

    Posted Tue February 25, 2025 10:56 AM

    Hello,

    How are you? I hope you 're very well. Now I 've a problem which states that ( If I have 3 systems in sysplex , system A, B and system C. If I configured system A and System B to have the same master key and the same CKDS, PKDS AND TKDS. System C uses the different master key and the different CKDS, PKDS AND TKDS. Now I modified in the procedure of csf in System C to take the same CKDS, PKDS AND TKDS of System A and B, but the master key still different and I want to make the master key in C is the same of A and B without changing the master key on System A,B).

    Best Regards,

    Ahmed Talaat



    ------------------------------
    ahmed talaat
    ------------------------------


  • 2.  RE: Setting a master key on a sysplex system

    Posted Tue February 25, 2025 11:30 AM

    You should be able to load the same MKs on System C as the new master keys and then either restart ICSF on System C (which will automatically promote) or perform a Set MK.



    ------------------------------
    Eric Rossman
    ------------------------------



  • 3.  RE: Setting a master key on a sysplex system

    Posted Wed February 26, 2025 09:07 AM

    Hello,

    Can you guide me to how to load mk on System C from A through a way either than TKE?

    Best Regards,



    ------------------------------
    ahmed talaat
    ------------------------------



  • 4.  RE: Setting a master key on a sysplex system

    Posted Wed February 26, 2025 09:17 AM
    Edited by Eric Rossman Wed February 26, 2025 09:18 AM

    All of what I'm summarizing is described in the ICSF Administrator's Guide, Chapter 8 (https://www.ibm.com/docs/en/zos/3.1.0?topic=keys-entering-master-key-parts)

    From the main ICSF panel (CSF@PRIM), option 1 is the Coprocessor Management panel.

    On that panel (https://www.ibm.com/docs/en/zos/3.1.0?topic=panels-csfcmp00-coprocessor-management-panel), option E next to all the cards, then enter the MK type (AES or DES for the CKDS), the part is FIRST, then enter the same MK part used on A and B. Repeat with zero or more MIDDLE and the FINAL part(s) would would be the same as used on A and B). Once both the AES and DES new MKs are in FULL state, you can use the Set MK option to make them current since they will now match the CKDS.



    ------------------------------
    Eric Rossman
    ------------------------------



  • 5.  RE: Setting a master key on a sysplex system

    Posted Wed February 26, 2025 01:02 PM

    If you do not know the current MKs on A and B, your only options are either:

    1. Use a TKE
    2. Load new AES and DES MKs on A and B, reencipher the CKDS (or coordinated change master key), then load those same new MKs on system C following my other instructions.


    ------------------------------
    Eric Rossman
    ------------------------------