Note: The PKA callable services control may not be active on your
system. When the control is not active, all steps referring to the
control can be ignored.
It is recommended that the CKDS and PKDS dynamic services be disabled
during the master key change. This is not necessary when using the
coordinated change master key procedure.
When you enter or change the RSA-MK, you must first disable the
PKA callable services control. This requirement applies only to the
RSA-MK. You do not need to disable PKA callable services control in
order to enter or change the ECC-MK.
- Access the administrative control functions by choosing option
4, ADMINCNTL, on the ICSF Primary Menu panel.
The CSFACF00 — Administrative Control Functions panel appears.
- Enter the appropriate character and press ENTER.
- To enable the dynamic CKDS update services control, enter an ‘E’
before the Dynamic CKDS Access function.
- To disable the dynamic CKDS update services control, enter a ‘D’
before the Dynamic CKDS Access function.
- To enable the PKA callable services control, enter an 'E' before
the PKA Callable Services function.
- To disable the PKA callable services control, enter a 'D' before
the PKA Callable Services function.
- To enable the dynamic PKDS update services control, enter an ‘E’
before the Dynamic PKDS Access function.
- To disable the dynamic PKDS update services control, enter a ‘D’
before the Dynamic PKDS Access function.
You can use a utility program to reencipher the CKDSs and change
the master key instead of using the panels. See Symmetric Master Keys and the CKDS, for instructions on how to use the utility
program to reencipher a disk copy of a CKDS and to change a master
key.