You can use the Master Key Entry panels to enter clear master key parts. The way you obtain master key parts depends on the security guidelines in your enterprise. You may receive master key parts from a key distribution center or you may generate your own key parts using the ICSF random number utility.
When you enter the RSA master key (RSA-MK) the first time, the PKA callable services control is initially disabled. Once you have entered the RSA-MK and initialized the PKDS, the PKA callable services control will be enabled automatically. When you change the RSA-MK, you need to disable the PKA callable services control. To enable and disable the PKA callable services control refer to Steps for enabling and disabling PKA callable services and Dynamic CKDS/PKDS Access.
To enter master key parts that you do not generate using the random number utility, continue with Steps for entering the first master key part.
To begin master key entry by generating random numbers for the key parts, continue with Generating master key data for master key entry.