Changes made in Cryptographic Support for z/OS V1R13-V2R1 (FMID HCR77A1)

This document contains information previously presented in z/OS ICSF Administrator's Guide, SA22-7521-11, which supports z/OS Version 1 Release 13.

This document is for ICSF FMID HCR77A1. This release of ICSF runs on z/OS V1R13, and z/OS V2R1, and only on zSeries hardware.

New information

A new section has been added to Managing CCA Master Keys describing New Master Keys Automatically Set When ICSF Started
The Displaying installation options section of Viewing and Changing System Status has been updated with the new CTRACE option.
A new ICSFMIG77A1_COPROCESSOR_ACTIVE health check has been added to Using ICSF Health Checks.
A new section, Updating the PKDS with the ECC master key, has been added to Managing CCA Master Keys.
CSFCMP00 — Coprocessor Management panel has been modified.
System authorization facility (SAF) controls has been updated in multiple places to include information about:
- Symmetric Key Export with Data, CSNDSXD
- CSFOWH, CSFOWH1
- CSFRNG CSFRNGL
The Callable Service and its Exit Identifier table in Displaying installation exits of Viewing and Changing System Status has been updated with new information about:
- Authentication Parameter Generate
- Recover PIN From Offset
- Symmetric Key Export with Data
Callable services affected by key store policy has been updated with new information about:
- Authentication Parameter Generate
- Recover PIN From Offset
- Symmetric Key Export with Data
- Unique Key Derive
The Operational Key Load, and the Operational Key Load - Variable-Length Tokens, access control points for callable services CSNBOKL / CSNEOKL have been added to the CCA access control points and ICSF utilities appendix and removed from the ICSF Application Programmers’s Guide.

Displaying cryptographic coprocessor status in Viewing and Changing System Status has been updated with new and modified status values.
Managing CCA Master Keys, section Updating the CKDS with the AES master key has been updated with new and modified instructions.
The following sections have been renamed, rewritten, enhanced, and reorganized for clarity:
- Steps for performing a local change master key has been renamed Changing the master keys.
- Steps for enabling and disabling PKA callable services and Dynamic CKDS/PKDS Access is new information within Changing the master keys.
- Symmetric Master Keys and the CKDS
- Steps for reenciphering the CKDS and performing a local symmetric master key change
- Asymmetric master keys and the PKDS
- Steps for enabling and disabling PKA callable services and PKDS updates, and Steps for performing a local PKDS change master key, have been replaced by Steps for reenciphering the PKDS and performing a local asymmetric master key change
Many ICSF panel screen shots have been moved to appendix ICSF Panels.
All instructions previously displaying ICSF panels have been adjusted accordingly.

In z/OS V2R1 support for z900/z800 and z990/z890 was removed. HCR77A1 removes support for the hardware present on z900/z800 (CCF and PCICC). This documentation reflects the removal of that support.
z990/z890 (PCIXCC and PCICA) will continue to be supported because HCR77A1 runs on z/OS V1R13. In addition, a number of software functions (and their documentation) that rely on the presence of CCF and PCICC features or do not serve a purpose without these features is removed.
The TRACEENTRY option has been deleted from the Displaying installation options section of Viewing and Changing System Status.
A caution was added to Using KGUP for key exchange and Syntax of the ADD and UPDATE control statements regarding KGUP not creating complementary key control statement or key label that has CLEAR parm specified in the KGUP statement.
The section Sharing and migrating a CKDS and PKDS between a CCF system and a non-CCF system has been relocated to the ICSF Systems Programmer’s Guide.