/* Rexx */
/* Sample: Generate a secure AES DATA key and store in the CKDS */
/*-------------------------------------------------------------------*/
/* Description: */
/* */
/* This REXX contains samples that show how to generate and store an */
/* AES DATA key. */
/* */
/* How To Run: */
/* - Execute this script from TSO */
/* (e.g. EX 'HLQ.MLD.LLQ(AESBASIC)') */
/*-------------------------------------------------------------------*/
signal on novalue;
/* CLEANUP labels in use for this sample */
aes_key_label = left('ICSF.SECRET.AES256.KEY001',64);
krd_label = aes_key_label;
Call CSNBKRD;
/*********************************************************************/
/* Generate a 256-bit AES DATA key */
/*********************************************************************/
kgn_key_form = 'OP ';
kgn_key_length = 'KEYLN32 ';
kgn_key_type_1 = 'AESDATA ';
kgn_key_type_2 = '';
kgn_kek_identifier_1 = copies('00'x,64);
kgn_kek_identifier_2 = '';
kgn_generated_key_identifier_1 = copies('00'x,64);
kgn_generated_key_identifier_2 = '';
Call CSNBKGN;
say "Secure key label: " aes_key_label;
say "Secure key token: ";
say c2x(kgn_generated_key_identifier_1);
/*********************************************************************/
/* Store the key in the CKDS */
/*********************************************************************/
krc2_label = aes_key_label;
krc2_token_length = '00000040'x;
krc2_token = kgn_generated_key_identifier_1;
Call CSNBKRC2;
say "-----------------------------------------------------------------"
say "End of Sample"
say "-----------------------------------------------------------------"
exit;
/* --------------------------------------------------------------- */
/* CSNBKGN - Key Generate */
/* */
/* Generates either one or two DES or AES keys encrypted under a */
/* master key (internal form) or KEK (external form). */
/* */
/* See the ICSF Application Programmer's Guide for more details. */
/* --------------------------------------------------------------- */
CSNBKGN:
KGN_RC = 'FFFFFFFF'x;
KGN_RS = 'FFFFFFFF'x;
KGN_exit_data_length = '00000000'x;
KGN_exit_data = '';
ADDRESS linkpgm "CSNBKGN",
'KGN_RC' 'KGN_RS' ,
'KGN_exit_data_length' 'KGN_exit_data' ,
'KGN_key_form' 'KGN_key_length' ,
'KGN_key_type_1' 'KGN_key_type_2' ,
'KGN_kek_identifier_1' 'KGN_kek_identifier_2' ,
'KGN_generated_key_identifier_1' 'KGN_generated_key_identifier_2';
if (KGN_RC /= '00000000'x) Then
do;
say 'KGN Failed (rc=' c2x(KGN_RC)' rs='c2x(KGN_rs)')' ;
exit;
end;
Return;
/* --------------------------------------------------------------- */
/* CSNBKRC2 - Key Record Create2 */
/* */
/* Adds a key token to the CKDS. */
/* */
/* See the ICSF Application Programmer's Guide for more details. */
/* --------------------------------------------------------------- */
CSNBKRC2:
krc2_rc = 'FFFFFFFF'x;
krc2_rs = 'FFFFFFFF'x;
krc2_exit_data_length = '00000000'x;
krc2_exit_data = '';
krc2_rule_count = '00000000'x;
krc2_rule_array = '';
ADDRESS LINKPGM "CSNBKRC2",
"krc2_rc",
"krc2_rs",
"krc2_exit_data_length",
"krc2_exit_data",
"krc2_rule_count",
"krc2_rule_array",
"krc2_label",
"krc2_token_length",
"krc2_token";
if (KRC2_RC /= '00000000'x) Then
do;
say 'KRC2 Failed (rc=' c2x(KRC2_RC)' rs='c2x(KRC2_rs)')' ;
exit;
end;
return;
/* --------------------------------------------------------------- */
/* CSNBKRD - Key Record Delete */
/* */
/* Deletes a key record from the CKDS. */
/* */
/* See the ICSF Application Programmer's Guide for more details. */
/* --------------------------------------------------------------- */
CSNBKRD:
krd_rc = 'FFFFFFFF'x;
krd_rs = 'FFFFFFFF'x;
krd_exit_data_length = '00000000'x;
krd_exit_data = '';
krd_rule_array_count = '00000001'x;
krd_rule_array = 'LABEL-DL';
ADDRESS LINKPGM "CSNBKRD",
"krd_rc",
"krd_rs",
"krd_exit_data_length",
"krd_exit_data",
"krd_rule_array_count",
"krd_rule_array",
"krd_label";
if (KRD_RC /= '00000000'x & KRD_RS /= '0000271C'x) Then
say 'KRD Failed (rc=' c2x(KRD_RC)' rs='c2x(KRD_rs)')' ;
return;
/* --------------------------------------------------------------- */
/* Debug ;-) */
/* --------------------------------------------------------------- */
NOVALUE:
Say "Condition NOVALUE was raised."
Say CONDITION("D") "variable was not initialized."
Say SOURCELINE(sigl)
Exit