Updating the CKDS with the AES master key

On systems that support the AES master key, you can add the AES master key to any existing CKDS. It is also possible to add the DES master key to a CKDS that was initialized with only the AES master key.

There are two options for updating the CKDS on the CKDS Operations panel.

Option 3 will add the missing master key verification pattern to the CKDS header record. The CKDS will not become the active CKDS and the master key will not be set. Use this option if you have more than one CKDS to update as a CKDS cannot be updated if the new master key register is empty. The last CKDS should be processed using option 4.
Option 4 will add the missing master key verification pattern, make the specified CKDS the active CKDS and set the master keys. This option should be used if you have only one CKDS to update or to update the last of your CKDSs after all other CKDSs have been updated using option 3.

These are the steps to update the CKDS:

Load the new AES master key by using the master key entry panels or by using TKE. The AES master key must be loaded on all active coprocessors.
From the ICSF Primary Menu panel, select option 2, MASTER KEY MGMT.
From the CSFMKM10 — Key Data Set Management panel, select option 1 for CKDS MK MANAGEMENT.
The CSFMKM20 — CKDS Management panel appears, select option 1, CKDS OPERATIONS.
The CSFCKD20 — CKDS Operations panel appears. In the CKDS field, enter the name of an existing, initialized CKDS.
If updating multiple CKDS, for all but the last CKDS, choose option 3, Update an existing CKDS and press ENTER. ICSF will check the status of the new master key registers and that the master key verification pattern of the master key is written to the CKDS header record.
Note: All the CKDSs that you wish to update should be processed prior to going to step 6.
If updating the last or only CKDS, choose option 4, Update an existing CKDS and activate master keys, and press ENTER. ICSF will check the status of the new master key registers and that the master key verification pattern of the master key is written to the CKDS header record. The CKDS will become the active CKDS and set the master key.