Changes made in Cryptographic Support for z/OS V1R11-R13 (FMID HCR7790)

This document contains information previously presented in z/OS ICSF System Programmer's Guide, SA22-7520-15.

This document is for ICSF FMID HCR7790. This release of ICSF runs on z/OS V1R11, z/OS V1R12, and z/OS V1R13 and only on zSeries hardware.

New information

Exit identifiers for new callable services described in Table 1.
New system abend codes summarized in System abend codes.
Migration action for moving from a version of ICSF prior to FMID HCR7780 to FMID HCR7780 or HCR7790 described in Ensure the expected CCA master key support is available
A new message, CSFM540I, was added to indicate a card has been fenced off during ICSF initialization. See notes in Starting and stopping ICSF for more information.
A new health check, ICSF_COPROCESSOR_STATE_NEGCHANGE, was added to detect a degradation in the state of a coprocessor or accelerator. See notes in Starting and stopping ICSF for more information.
A new health check, ICSFMIG_DEPRECATED_SERV_WARNINGS, was added to detect the use of a services that will not be supported in subsequent releases. See Migrating from the IBM eServer zSeries 900 for more information.

Changed information

Changes to callable services summarized in Table 1.
The process to reencipher the PKDS and change the RSA master key has changed for z196 systems with CEX3C coprocessors and the Sep. 2011 licensed internal code (LIC). See Changing the RSA master key.
For clarity:
- CSNBKRC and CSNEKRC, which had been referred to as the "Key Record Create" service, are now referred to as the "CKDS Key Record Create" service
- CSNBKRC2 and CSNEKRC2, which had been referred to as the "Key Record Create2" service, are now referred to as the "CKDS Key Record Create2" service
- CSNBKRD and CSNEKRD, which had been referred to as the "Key Record Delete" service, are now referred to as the "CKDS Key Record Delete" service
- CSNBKRR and CSNEKRR, which had been referred to as the "Key Record Read" service, are now referred to as the "CKDS Key Record Read" service
- CSNBKRR2 and CSNEKRR2, which had been referred to as the "Key Record Read2" service, are now referred to as the "CKDS Key Record Read2" service
- CSNBKRW and CSNEKRW, which had been referred to as the "Key Record Write" service, are now referred to as the "CKDS Key Record Write" service
- CSNBKRW2 and CSNEKRW2, which had been referred to as the "Key Record Write2" service, are now referred to as the "CKDS Key Record Write2" service
- CSNDKRC and CSNFKRC, which had been referred to as the "PKDS Record Create" service, are now referred to as the "PKDS Key Record Create" service
- CSNDKRD and CSNFKRD, which had been referred to as the "PKDS Record Delete" service, are now referred to as the "PKDS Key Record Delete" service
- CSNDKRR and CSNFKRR, which had been referred to as the "PKDS Record Read" service, are now referred to as the "PKDS Key Record Read" service
- CSNDKRW and CSNFKRW, which had been referred to as the "PKDS Record Write" service, are now referred to as the "PKDS Key Record Write" service