Changes made in Cryptographic Support for z/OS V1R13 - z/OS V2R1 (FMID HCR77A1)

This document contains information previously presented in z/OS ICSF System Programmer's Guide, SA22-7520-17.

This document is for ICSF FMID HCR77A1. This release of ICSF runs on z/OS V1R13 and z/OS V2R1 and only on zSeries hardware.

New information

Table 1 in Installation, initialization, and customization has been updated with new information.
Table 1 in Migration has been updated with new information.
The 'online' coprocessor status is no longer supported. See Migration for details.
New reason codes were added to System abend codes in Migration.
Table 1 in Installation exits has been updated with new information.
The callable services section of Systems without Cryptographic features has had ICSF Query Facility2 (CSFIQF2) added to the list for FMID HCR77A1.

Changed information

There are multiple changes in this document for the simplification of cryptographic coprocessor configuration. Affected sections are:
- Steps to start ICSF for the first time in Installation, initialization, and customization.
- The following Migration sections:
  - Ensure the expected CCA master key support is available.
  - SMF records.
The Installation, initialization, and customization section, “Parameters in the installation options data set”, has been updated with additional information about the SSM option.
Migration has been updated for FMID HCR77A1.
The Migration section Migrating from earlier software releases overview description has been updated for HCR77A1.
The Operating ICSF section Adding and removing cryptographic coprocessors has been completely rewritten.
The Operating ICSF section Component trace has been completely rewritten.
The Cryptographic Communication Vector Table (CCVT) in Diagnosis reference information, section Data areas has been updated with new information for field name CCVT1FLG.
ICSF SMF records section Record type 82 (52) — ICSF record has multiple updates.
Helpful hints for ICSF first time startup has been completely rewritten.
Systems without Cryptographic features has been completely rewritten.

Deleted information

In z/OS V2R1, support for z900/z800 and z990/z890 is removed. HCR77A0 ships in the base of z/OS V2R1 and will continue to support these older hardware environments. HCR77A1 removes support for the hardware present on z900/z800 (CCF and PCICC). z990/z890 (PCIXCC and PCICA) will continue to be supported because HCR77A1 will still run on z/OS V1R13.
Additionally, a number of software functions that rely on the presence of CCF and PCICC features or do not serve a purpose without these features is removed, including the Managing Keys According to the ANSI X9.17 Standard chapter and the Using ICSF with BSAFE appendix.
Support for the following services has been removed in HCR77A1:
- ANSI X9.17 EDC Generate (CSNAEGN and CSNGEGN)
- ANSI X9.17 Key Export (CSNAKEX and CSNGKEX)
- ANSI X9.17 Key Import (CSNAKIM and CSNGKIM)
- ANSI X9.17 Key Translate (CSNAKTR and CSNGKTR)
- ANSI X9.17 Transport Key Partial Notarize (CSNATKN and CSNGTKN)
- Ciphertext Translate (CSNBCTT or CSNBCTT1 and CSNECTT or CSNECTT1)
- Transform CDMF Key (CSNBTCK and CSNETCK)
- User Derived Key (CSFUDK and CSFUDK6)
- PKSC Interface Callable Service (CSFPKSC)
The following reason codes are no longer issued:
- 9 (9)
- 13 (19)
- 3C (60)
- 41 (65)
- 42 (66)
- 48 (72)
- 49 (73)
- 4A (74)
- 5A (90)
- 73 (115)
- 74 (116)
- 8C (140)
- 8D (141)
- 8E (142)
- 90 (144)
- 92 (146)
- 94 (148)
- 98 (152)
- A3 (163)
- A4 (164)
- A6 (166)
- A7 (167)
- A8 (168)
- A9 (169)
- AC (172)
- AD (173)
- B6 (182)
- 103 (259)
- 104 (260)
- 107 (263)
- 108 (264)
- 109 (265)
- 10A (266)
- 197 (407)
- 199 (409)
- 205 (517)
- 207 (519)
- 301 (769)
- 400 (1024)
- 401 (1025)
- 402 (1026)
- 407 (1031)
- 408 (1032)
- 409 (1033)
- 40E (1038)
- 40F (1039)
- 410 (1040)
- 41B (1051)
- 41D (1053)
- 423 (1059)
- 42B (1067)
- 42C (1068)
- 42D (1069)
- 432 (1074)
- 433 (1075)
- 449 (1097)
- 44A (1098)
- 44B (1099)
- 44D (1101)
- 44E (1102)
- 46B (1131)
- 470 (1136)
- 471 (1137)