ICSF provides invocation points where you can use installation exits to perform processing that is specific to your installation. For example, ICSF provides a preprocessing and postprocessing exit invocation for each ICSF callable service. You can write and define an exit to set return codes at postprocessing of a callable service.
You must define each installation exit in the installation options data set. You define the ICSF name for the exit, the load module name of the exit, and the action ICSF takes if the exit fails. You can use the panels to view the ICSF name for each exit invocation. For a defined exit, you view the exit's load module name and fail options.
The mainline exits are called when you start and stop ICSF. The key generator utility program exit is called during key generator utility program processing. The callable services exits are called during each of the callable services. The CKDS conversion program exit is called during conversion of CUSP or PCF CKDS to ICSF CKDS format. The Single-record, read-write exit is called when an access to a single record is made to a disk copy of the CKDS. The security exits are called during initialization and stopping of ICSF, during a call to a callable service, and during access of a CKDS entry.
For a detailed description of the ICSF exits, see z/OS Cryptographic Services ICSF System Programmer's Guide.
The first of the CSFSOP30 — Installation Exits Display panels appears.
The CSFSOP30 — Installation Exits Display panel displays the ICSF name for all the possible installation exits your installation can write.
The system programmer specified the exit identifier, the load-module-name, and the failure option for each exit your installation uses with the EXIT keyword in the installation options data set. On this panel, you can view information about any exit that is specified in the installation options data set. The exit identifier is the ICSF name for the exit.
| General ICSF Exit | Exit Identifier |
|---|---|
| Conversion Exit | CSFCONVX |
| Cryptographic Key Data Set Retrieval Exit | CSFCKDS |
| Key Generator Utility Program Exit | CSFKGUP |
| Mainline Exits | CSFEXIT2, CSFEXIT3, CSFEXIT4, CSFEXIT5 |
| Security Initialization Exit Point | CSFESECI |
| Security Key Exit Point | CSFESECK |
| Security Service Exit Point | CSFESECS |
| Security Termination Exit Point | CSFESECT |
| Single-record, read-write Exit Point | CSFSRRW |
| Service | Exit Identifier |
|---|---|
| Authentication Parameter Generate | CSFAPG |
| Clear PIN Encrypt | CSFCPE |
| Clear PIN Generate Alternate | CSFCPA |
| Clear Key Import | CSFCKI |
| Cipher/Decipher | CSFEDC |
| Cipher Text Translate2 | CSFCTT2 |
| Cipher Text Translate2 (with ALET) | CSFCTT3 |
| Control Vector Translate | CSFCVT |
| Cryptographic Variable Encipher | CSFCVE |
| CVV Key Combine | CSFCKC |
| Data Key Import | CSFDKM |
| Decode | CSFDCO |
| Decipher | CSFDEC |
| Decipher (with ALET) | CSFDEC1 |
| Data Key Export | CSFDKX |
| Digital Signature Generate | CSFDSG |
| Digital Signature Verify | CSFDSV |
| Diversified Key Generate | CSFDKG |
| Diversified Key Generate2 | CSFDKG2 |
| DK Deterministic PIN Generate | CSFDDPG |
| DK Migrate PIN | CSFDMP |
| DK PAN Modify in Transaction | CSFDPMT |
| DK PAN Translate | CSFDPT |
| DK PIN Change | CSFDPC |
| DK PIN Verify | CSFDPV |
| DK PRW Card Number Update | CSFDPNU |
| DK PRW CMAC Generate | CSFDPCG |
| DK Random PIN Generate | CSFDRPG |
| DK Regenerate PRW | CSFDRP |
| ECC Diffie-Hellman | CSFEDH |
| Encode | CSFECO |
| Encipher under Master Key | CSFEMK |
| Encipher | CSFENC |
| Encipher (with ALET) | CSFENC1 |
| Encrypted PIN Generate | CSFEPG |
| FPE Decipher | CSFFPED |
| FPE Encipher | CSFFPEE |
| FPE Translate | CSFFPET |
| HMAC Generate | CSFHMG |
| HMAC Verify | CSFHMV |
| ICSF Multi-Purpose Service | CSFMPS |
| Key Data Set List | CSFKDSL |
| Key Data Set Metadata Read | CSFKDMR |
| Key Data Set Metadata Write | CSFKDMW |
| Key Export | CSFKEX |
| Key Generate | CSFKGN |
| Key Generate2 | CSFKGN2 |
| Key Import | CSFKIM |
| Key Part Import | CSFKPI |
| Key Part Import2 | CSFKPI2 |
| Key Record Create | CSFKRC |
| Key Record Create2 | CSFKRC2 |
| Key Record Delete | CSFKRD |
| Key Record Read | CSFKRR |
| Key Record Read2 | CSFKRR2 |
| Key Record Write | CSFKRW |
| Key Record Write2 | CSFKRW2 |
| Key Test | CSFKYT |
| Key Test2 | CSFKYT2 |
| Key Test Extended | CSFKYTX |
| Key Translate | CSFKTR |
| MAC Generate | CSFMGN |
| MAC Generate (with ALET) | CSFMGN1 |
| MAC Generate2 | CSFMGN2 |
| MAC Generate2 (with ALET) | CSFMGN3 |
| MAC Verify | CSFMVR |
| MAC Verify (with ALET) | CSFMVR1 |
| MAC Verify2 | CSFMVR2 |
| MAC Verify2 (with ALET) | CSFMVR3 |
| MDC Generate | CSFMDG |
| MDC Generate (with ALET) | CSFMDG1 |
| Multiple Clear Key Import | CSFCKM |
| Multiple Secure Key Import | CSFSCKM |
| One-Way Hash Generate | CSFOWH |
| One-Way Hash Generate (with ALET) | CSFOWH1 |
| PCI Interface | CSFPCI |
| Recover PIN From Offset | CSFPFO |
| PIN Change/Unblock | CSFPCU |
| PIN Generate | CSFPGN |
| PIN Generate | CSFPGN |
| PIN Translate | CSFPTR |
| PIN Verify | CSFPVR |
| PKA Decrypt | CSFPKD |
| PKA Encrypt | CSFPKE |
| PKA Key Generate | CSFPKG |
| PKA Key Import | CSFPKI |
| PKA Key Token Change | CSFPKTC |
| PKA Key Translate | CSFPKT |
| PKDS Record Create | CSFPKRC |
| PKDS Record Delete | CSFPKRD |
| PKDS Record Read | CSFPKRR |
| PKDS Record Write | CSFPKRW |
| Prohibit Export | CSFPEX |
| Prohibit Export Extended | CSFPEXX |
| Random Number Generate | CSFRNG |
| Random Number Generate Long | CSFRNGL |
| Remote Key Export | CSFRKX |
| Restrict Key Attribute | CSFRKA |
| Retained Key Delete | CSFRKD |
| Retained Key List | CSFRKL |
| Secure Key Import | CSFSKI |
| Secure Key Import2 | CSFSKI2 |
| Secure Messaging for Keys | CSFSKY |
| Secure Messaging for PINs | CSFSPN |
| SET Block Compose | CSFSBC |
| SET Block Decompose | CSFSBD |
| Symmetric Algorithm Decipher | CSFSAD |
| Symmetric Algorithm Encipher | CSFSAE |
| Symmetric Key Generate | CSFSYG |
| Symmetric Key Import | CSFSYI |
| Symmetric Key Import2 | CSFSYI2 |
| Symmetric Key Export | CSFSYX |
| Symmetric MAC Generate | CSFSMG |
| Symmetric MAC Generate (with ALET) | CSFSMG1 |
| Symmetric MAC Verify | CSFSMV |
| Symmetric MAC Verify (with ALET) | CSFSMV1 |
| Symmetric Key Export with Data | CSFSXD |
| Transaction Validation | CSFTRV |
| Trusted Block Create | CSFTBC |
| TR-31 Export | CSFT31X |
| TR-31 Import | CSFT31I |
| Unique Key Derive | CSFUDK |
| VISA CVV Service Generate | CSFCSG |
| VISA VISA CVV Service Verify | CSFCSV |
| Service | Exit Identifier |
|---|---|
| Encipher under Master Key | CSFEMK |
| CUSP/PCF GENKEY Service | CSFGKC |
| CUSP/PCF RETKEY Service | CSFRTC |
| Cipher/Decipher | CSFEDC |
The load module name is the name of the module that contains the exit. The LOAD MODULE column on the panel lists the load module name for each exit. The OPTIONS column on this panel lists the action to occur if the exit fails.