Steps to create the CKDS

The CKDS must be a key-sequenced data. There are three formats: Allocate the CKDS on a permanently resident volume.

Attention: Ensure that this volume is not subject to data set migration. If the CKDS is migrated, message CSFM450E is issued and ICSF ends.

For detailed information about calculating space for a VSAM data set and an explanation of keyed-direct update processing and what happens when control area and control interval splits occur, see z/OS DFSMS Access Method Services Commands.

  1. Determine the amount of primary space you need to allocate for the CKDS. This should reflect the total number of entries you expect the data set to contain originally. Besides transport keys, PIN keys, data-encrypting keys, data-translating keys, and MAC keys, the CKDS contains a header record and system keys. ICSF no longer uses the system keys as of HCR77A1, but they remain for older releases which may share the CKDS.

    Fixed length record format: Each record is 252 bytes long. Allocate space for all of the installation and system keys you expect to store in the CKDS.

    Variable length record format: The minimum size of a record will be 276 bytes. Records containing fixed-length DES and AES keys will be 332 bytes long. Records containing variable-length symmetric key tokens may be up to 993 bytes long. Allocate space for all of the installation and system keys you expect to store in the CKDS.

    KDSR format: The minimum size of a record will be 196 bytes. Records containing fixed-length DES and AES keys will be 252 bytes long or 304 bytes long if the original record had user data. Records containing variable-length symmetric key tokens may be up to 965 bytes long. In addition, installations may add metadata to any record. If you are planning to add metadata, account for the size of the metadata in the length of records. Allocate space for all of the installation and system keys you expect to store in the CKDS.

  2. Determine the amount of secondary space to allocate for CKDS.

    This should reflect the total number of entries you expect to add to the data set.

    To access keys, VSAM uses the key label as the VSAM key. This means that VSAM adds keys to the data set in collating sequence. That is, if two keys named A and B are in the data set, A appears earlier in the data set than B. As a result, adding keys to the data set can cause multiple VSAM control interval splits and control area splits. For example, a split might occur if the data set contains keys A, B, and E and you add C. In this case, C must be placed between B and E. These splits can leave considerable free space in the data set and can affect KGUP performance.

    The amount of secondary space you allocate must take into account the number of control interval and control area splits that might occur. If the disk copy of the CKDS uses a significant amount of secondary space, you can copy it into another disk copy that you created with more primary space. You can do this by using the Access Method Services (AMS) REPRO command or the AMS EXPORT/IMPORT commands.

    The BUFFERSPACE parameter on the AMS DEFINE CLUSTER command (required by Step 3) lets VSAM optimize space for control area and control interval splits.

  3. Create an empty VSAM data set to use as the CKDS. ICSF provides a sample job to define the CKDS in member CSFCKDS of SYS1.SAMPLIB.

    Use the AMS DEFINE CLUSTER command to define the data set and to allocate its space.

    Note: To improve security and reliability of the data that is stored on the CKDS:
    • Use the ERASE and WRITECHECK parameters on the AMS DEFINE CLUSTER command. ERASE overwrites data records with binary zeros when the CKDS cluster is deleted. WRITECHECK provides hardware verification of all data that is written to the data set.
    • Create a Security Server (RACF) data set profile for the CKDS. Ensure that no one has access to the CKDS data set by protecting the CKDS data set name resource in the DATASET class. If a data set profile is used, as opposed to using the PROTECTALL(FAIL) option for example, the profile should have a UACC of NONE.

    Fixed length record format: Allocate a disk copy of the CKDS by defining a VSAM cluster as in this SYS1.SAMPLIB CSFCKDS member sample:

    //CSFCKDS   JOB <JOB CARD PARAMETERS>
    //********************************************************************          
    //*  Licensed Materials - Property of IBM                            *          
    //*  5650-ZOS                                                        *          
    //*  Copyright IBM CORP. 2002, 2015                                  *          
    //*                                                                  *          
    //* This JCL defines a VSAM CKDS capable only of fixed-length records*          
    //*                                                                  *          
    //*  CAUTION: This is neither a JCL procedure nor a complete JOB.    *          
    //*  Before using this JOB step, you will have to make the following *          
    //*  modifications:                                                  *          
    //*                                                                  *          
    //*  1) Add the job parameters to meet your system requirements.     *          
    //*  2) Be sure to change CSF to the appropriate HLQ if you choose   *          
    //*     not to use the default.                                      *          
    //*  3) Change XXXXXX to the volid where you want your CKDS to       *          
    //*     reside. The CKDS needs to be on a permanently resident       *          
    //*     volume.                                                      *          
    //*                                                                  *          
    //* NOTE: This JCL is specific for creating a CKDS capable of only   *          
    //*       fixed-length records. There are samples for each of the    *          
    //*       other key data sets and formats.                           *          
    //*                                                                  *          
    //********************************************************************          
    //DEFINE  EXEC PGM=IDCAMS,REGION=4M                                             
    //SYSPRINT DD SYSOUT=*                                                          
    //SYSIN DD *                                                                    
      DEFINE CLUSTER (NAME(CSF.CSFCKDS)          -                                  
                      VOLUMES(XXXXXX)            -                                  
                      RECORDS(100 50)            -                                  
                      RECORDSIZE(252,252)        -                                  
                      KEYS(72 0)                 -                                  
                      FREESPACE(10,10)           -                                  
                      SHAREOPTIONS(2))           -                                  
                DATA (NAME(CSF.CSFCKDS.DATA)     -                                  
                      BUFFERSPACE(100000)        -                                  
                      ERASE                      -                                  
                      WRITECHECK)                -                                  
               INDEX (NAME(CSF.CSFCKDS.INDEX))                                      
    /*                 
    Variable length record format: Allocate a disk copy of the CKDS by defining a VSAM cluster as in this SYS1.SAMPLIB CSFCKD2 member sample:
    //CSFCKD2   JOB <JOB CARD PARAMETERS>
    //********************************************************************          
    //*  Licensed Materials - Property of IBM                            *          
    //*  5650-ZOS                                                        *          
    //*  Copyright IBM CORP. 2010, 2013                                  *          
    //*                                                                  *          
    //* This JCL defines a VSAM CKDS capable of variable-length records  *          
    //*                                                                  *          
    //*  CAUTION: This is neither a JCL procedure nor a complete JOB.    *          
    //*  Before using this JOB step, you will have to make the following *          
    //*  modifications:                                                  *          
    //*                                                                  *          
    //*  1) Add the job parameters to meet your system requirements.     *          
    //*  2) Be sure to change CSF to the appropriate HLQ if you choose   *          
    //*     not to use the default.                                      *          
    //*  3) Change XXXXXX to the volid where you want your CKDS to       *          
    //*     reside. The CKDS needs to be on a permanently resident       *          
    //*     volume.                                                      *          
    //*                                                                  *          
    //* NOTE: This JCL is specific for creating a CKDS capable of        *          
    //*       variable-length records, in non-KDSR format. There are     *          
    //*       samples for each of the other key data sets and formats.   *          
    //*                                                                  *          
    //********************************************************************          
    //DEFINE  EXEC PGM=IDCAMS,REGION=4M                                             
    //SYSPRINT DD SYSOUT=*                                                          
    //SYSIN DD *                                                                    
      DEFINE CLUSTER (NAME(CSF.CSFCKDS)          -                                  
                      VOLUMES(XXXXXX)            -                                  
                      RECORDS(100 50)            -                                  
                      RECORDSIZE(332,1024)       -                                  
                      KEYS(72 0)                 -                                  
                      FREESPACE(10,10)           -                                  
                      SHAREOPTIONS(2,3))         -                                  
                DATA (NAME(CSF.CSFCKDS.DATA)     -                                  
                      BUFFERSPACE(100000)        -                                  
                      ERASE                      -                                  
                      WRITECHECK)                -                                  
               INDEX (NAME(CSF.CSFCKDS.INDEX))                                      
    /*                                                                              
    KDSR record format: Allocate a disk copy of the CKDS by defining a VSAM cluster as in this SYS1.SAMPLIB CSFCKD3 member sample:
    //CSFCKD3   JOB <JOB CARD PARAMETERS>
    //********************************************************************          
    //*  Licensed Materials - Property of IBM                            *          
    //*  5650-ZOS                                                        *          
    //*  Copyright IBM CORP. 2013                                        *          
    //*                                                                  *          
    //* This JCL defines a VSAM CKDS capable of variable-length records  *          
    //* in common record format                                          *          
    //*                                                                  *          
    //*  CAUTION: This is neither a JCL procedure nor a complete JOB.    *          
    //*  Before using this JOB step, you will have to make the following *          
    //*  modifications:                                                  *          
    //*                                                                  *          
    //*  1) Add the job parameters to meet your system requirements.     *          
    //*  2) Be sure to change CSF to the appropriate HLQ if you choose   *          
    //*     not to use the default.                                      *          
    //*  3) Change XXXXXX to the volid where you want your CKDS to       *          
    //*     reside. The CKDS needs to be on a permanently resident       *          
    //*     volume.                                                      *          
    //*                                                                  *          
    //* NOTE: This JCL is specific for creating a CKDS capable of        *          
    //*       variable-length records, in KDSR format. There are         *          
    //*       samples for each of the other key data sets and formats.   *          
    //*                                                                  *          
    //********************************************************************          
    //DEFINE  EXEC PGM=IDCAMS,REGION=4M                                             
    //SYSPRINT DD SYSOUT=*                                                          
    //SYSIN DD *                                                                    
      DEFINE CLUSTER (NAME(CSF.CSFCKDS)          -                                  
                      VOLUMES(XXXXXX)            -                                  
                      RECORDS(100 50)            -                                  
                      RECORDSIZE(372,2048)       -                                  
                      KEYS(72 0)                 -                                  
                      FREESPACE(10,10)           -                                  
                      SHAREOPTIONS(2,3))         -                                  
                DATA (NAME(CSF.CSFCKDS.DATA)     -                                  
                      BUFFERSPACE(100000)        -                                  
                      ERASE                      -                                  
                      WRITECHECK)                -                                  
               INDEX (NAME(CSF.CSFCKDS.INDEX))                                      
    /*                                                                           

    You can change and use the Job Control Language according to the needs of your installation. Please note that the JCL to define the CKDS differs from the JCL that defines the PKDS (RECORDSIZE and CISZ parameters). For more information about allocating a VSAM data set, see z/OS DFSMS Access Method Services Commands.