Planning for nondisruptive install of crypto features

Crypto Express feature can be added to logical partitions non-disruptively using the Change LPAR Cryptographic Controls task. For more information, see Changing LPAR cryptographic controls. Logical partitions can either be configured in advance or dynamically with the appropriate domain indexes and Cryptographic numbers (see the Cryptographic Candidate List information under Crypto parameter descriptions).

If the customer plans to use ICSF or the optional cryptographic hardware, the CP Crypto Assist functions (CPACF DES/TDES) must be enabled. Many products take advantage of the cryptographic hardware using ICSF, so enabling CPACF is recommended. View the System Details panel to determine if the CPACF feature is installed. For more detailed information, see the z/OS® Cryptographic Services ICSF TKE Workstation User's Guide.

It is important to remember that when non-disruptively installing crypto adapters, the default configuration of the card is coprocessor (CCA Coprocessor). To change the type configuration of a crypt adapter, use the Cryptographic Configuration window. Once the crypt adapter has been installed, and the previous preparations made, the crypt adapter is available to any partition that specifies their assigned Cryptographic numbers in the Candidate List of the Image Activation Profile. To bring the crypto adapter online, use the Config On /Off Window.

The Cryptographic Online List needs to be set up in the Image Activation Profile to reflect the crypto adapter that you want to bring online automatically during the partition activation. If the Cryptographic Candidate List does not reflect the crypto adapter that you plan to use, then these crypto adapters are not available to the logical partition after this partition is activated. If the Cryptographic Online List is set up properly, the crypto adapter is brought online when the partition is activated and available to the operating system. Otherwise, a Configure On is necessary to bring the crypto adapter online in the logical partition.