To use this service, PKA callable services must be enabled for all RSA and DSS token types. For systems with CEX3C coprocessors, there is no PKA callable services control. The RSA master key must be valid to use this service.

To use this service for clear key ECC tokens, a current ECC master key is not required.

To use this service for encrypted key ECC tokens, the ECC master key must be valid.

This table lists the required cryptographic hardware for each server type and describes restrictions for this callable service.

Table 256. PKDS key record read required hardware

Server	Required cryptographic hardware	Restrictions
IBM zSeries 900	None.
IBM zSeries 990 IBM zSeries 890	None.
IBM System z9 EC IBM System z9 BC	None.