New master key register mismatch

For a coordinated change master key, all sysplex cluster members must have their new master key registers pre-loaded with the same master key values. For coordinated CKDS change master key, one of either the DES or AES new master key registers must be pre-loaded, or both may be pre-loaded on all sysplex cluster members. For coordinated PKDS change master key, one of either the RSA or ECC new master key registers must be pre-loaded, or both may be pre-loaded on all sysplex cluster members. For coordinated TKDS change master key, the P11 new master key register must be pre-loaded and committed on all sysplex cluster members.

If a sysplex cluster member's new master key registers do not match the initiator's new master key registers, the following error message will be displayed on the dialog. In this example, we are showing that a coordinated CKDS change master key failed because the AES new master key register did not match on one of the sysplex cluster members system.

THE AES NEW MASTER KEY REGISTERS ARE NOT CONSISTENT ACROSS ALL COPROCESSORS FOR 
THE SYSPLEX SYSTEMS PARTICIPATING IN THIS OPERATION. THEY MUST BE THE SAME. THIS 
ERROR WAS DETECTED ON A SYSTEM OTHER THAN THIS ONE.

In addition, the following message will be written to the ICSF job log.

CSFM615I COORDINATED CHANGE-MK FAILED. NEW MASTER KEYS INCORRECT ON sysname. 
         RC = return-code, RSN = reason-code.

To resolve this problem, the security administrator should compare all sysplex cluster members' new master key registers to ensure they match the initiators exactly. If a sysplex cluster member's new master key registers do not match, the security administrator should re-load them or clear them to match the values on the initiating system.

Additional information about the failure can be determined by looking up the return and reason codes in the "Return and Reason Codes" section of the z/OS Cryptographic Services ICSF Application Programmer's Guide.