Displaying installation exits

ICSF provides invocation points where you can use installation exits to perform processing that is specific to your installation. For example, ICSF provides a preprocessing and postprocessing exit invocation for each ICSF callable service. You can write and define an exit to set return codes at postprocessing of a callable service.

You must define each installation exit in the installation options data set. You define the ICSF name for the exit, the load module name of the exit, and the action ICSF takes if the exit fails. You can use the panels to view the ICSF name for each exit invocation. For a defined exit, you view the exit's load module name and fail options.

ICSF provides these types of exits:

The mainline exits are called when you start and stop ICSF. The key generator utility program exit is called during key generator utility program processing. The callable services exits are called during each of the callable services. The CKDS conversion program exit is called during conversion of CUSP or PCF CKDS to ICSF CKDS format. The Single-record, read-write exit is called when an access to a single record is made to a disk copy of the CKDS. The security exits are called during initialization and stopping of ICSF, during a call to a callable service, and during access of a CKDS entry.

For a detailed description of the ICSF exits, see z/OS Cryptographic Services ICSF System Programmer's Guide.

To display installation exits:
  1. Select option 3, OPSTAT, on the ICSF Primary Menu panel. The CSFSOP00 — Installation Options panel appears.
  2. Select option 2, Exits, on the CSFSOP00 — Installation Options panel.

    The first of the CSFSOP30 — Installation Exits Display panels appears.

    The CSFSOP30 — Installation Exits Display panel displays the ICSF name for all the possible installation exits your installation can write.

  3. Scroll through the screens, to view all of the installation exits.

    The system programmer specified the exit identifier, the load-module-name, and the failure option for each exit your installation uses with the EXIT keyword in the installation options data set. On this panel, you can view information about any exit that is specified in the installation options data set. The exit identifier is the ICSF name for the exit.

    Table 1 shows the names for some general ICSF exits. Table 2 and Table 3 show the ICSF name for each callable service exit.
    Table 1. General ICSF Exits and Exit Identifiers
    General ICSF Exit Exit Identifier
    Conversion Exit CSFCONVX
    Cryptographic Key Data Set Retrieval Exit CSFCKDS
    Key Generator Utility Program Exit CSFKGUP
    Mainline Exits CSFEXIT2, CSFEXIT3, CSFEXIT4, CSFEXIT5
    Security Initialization Exit Point CSFESECI
    Security Key Exit Point CSFESECK
    Security Service Exit Point CSFESECS
    Security Termination Exit Point CSFESECT
    Single-record, read-write Exit Point CSFSRRW
    Table 2. Callable Service and its Exit Identifier
    Service Exit Identifier
    Authentication Parameter Generate CSFAPG
    Clear PIN Encrypt CSFCPE
    Clear PIN Generate Alternate CSFCPA
    Clear Key Import CSFCKI
    Cipher/Decipher CSFEDC
    Cipher Text Translate2 CSFCTT2
    Cipher Text Translate2 (with ALET) CSFCTT3
    Control Vector Translate CSFCVT
    Cryptographic Variable Encipher CSFCVE
    CVV Key Combine CSFCKC
    Data Key Import CSFDKM
    Decode CSFDCO
    Decipher CSFDEC
    Decipher (with ALET) CSFDEC1
    Data Key Export CSFDKX
    Digital Signature Generate CSFDSG
    Digital Signature Verify CSFDSV
    Diversified Key Generate CSFDKG
    Diversified Key Generate2 CSFDKG2
    DK Deterministic PIN Generate CSFDDPG
    DK Migrate PIN CSFDMP
    DK PAN Modify in Transaction CSFDPMT
    DK PAN Translate CSFDPT
    DK PIN Change CSFDPC
    DK PIN Verify CSFDPV
    DK PRW Card Number Update CSFDPNU
    DK PRW CMAC Generate CSFDPCG
    DK Random PIN Generate CSFDRPG
    DK Regenerate PRW CSFDRP
    ECC Diffie-Hellman CSFEDH
    Encode CSFECO
    Encipher under Master Key CSFEMK
    Encipher CSFENC
    Encipher (with ALET) CSFENC1
    Encrypted PIN Generate CSFEPG
    FPE Decipher CSFFPED
    FPE Encipher CSFFPEE
    FPE Translate CSFFPET
    HMAC Generate CSFHMG
    HMAC Verify CSFHMV
    ICSF Multi-Purpose Service CSFMPS
    Key Data Set List CSFKDSL
    Key Data Set Metadata Read CSFKDMR
    Key Data Set Metadata Write CSFKDMW
    Key Export CSFKEX
    Key Generate CSFKGN
    Key Generate2 CSFKGN2
    Key Import CSFKIM
    Key Part Import CSFKPI
    Key Part Import2 CSFKPI2
    Key Record Create CSFKRC
    Key Record Create2 CSFKRC2
    Key Record Delete CSFKRD
    Key Record Read CSFKRR
    Key Record Read2 CSFKRR2
    Key Record Write CSFKRW
    Key Record Write2 CSFKRW2
    Key Test CSFKYT
    Key Test2 CSFKYT2
    Key Test Extended CSFKYTX
    Key Translate CSFKTR
    MAC Generate CSFMGN
    MAC Generate (with ALET) CSFMGN1
    MAC Generate2 CSFMGN2
    MAC Generate2 (with ALET) CSFMGN3
    MAC Verify CSFMVR
    MAC Verify (with ALET) CSFMVR1
    MAC Verify2 CSFMVR2
    MAC Verify2 (with ALET) CSFMVR3
    MDC Generate CSFMDG
    MDC Generate (with ALET) CSFMDG1
    Multiple Clear Key Import CSFCKM
    Multiple Secure Key Import CSFSCKM
    One-Way Hash Generate CSFOWH
    One-Way Hash Generate (with ALET) CSFOWH1
    PCI Interface CSFPCI
    Recover PIN From Offset CSFPFO
    PIN Change/Unblock CSFPCU
    PIN Generate CSFPGN
    PIN Generate CSFPGN
    PIN Translate CSFPTR
    PIN Verify CSFPVR
    PKA Decrypt CSFPKD
    PKA Encrypt CSFPKE
    PKA Key Generate CSFPKG
    PKA Key Import CSFPKI
    PKA Key Token Change CSFPKTC
    PKA Key Translate CSFPKT
    PKDS Record Create CSFPKRC
    PKDS Record Delete CSFPKRD
    PKDS Record Read CSFPKRR
    PKDS Record Write CSFPKRW
    Prohibit Export CSFPEX
    Prohibit Export Extended CSFPEXX
    Random Number Generate CSFRNG
    Random Number Generate Long CSFRNGL
    Remote Key Export CSFRKX
    Restrict Key Attribute CSFRKA
    Retained Key Delete CSFRKD
    Retained Key List CSFRKL
    Secure Key Import CSFSKI
    Secure Key Import2 CSFSKI2
    Secure Messaging for Keys CSFSKY
    Secure Messaging for PINs CSFSPN
    SET Block Compose CSFSBC
    SET Block Decompose CSFSBD
    Symmetric Algorithm Decipher CSFSAD
    Symmetric Algorithm Encipher CSFSAE
    Symmetric Key Generate CSFSYG
    Symmetric Key Import CSFSYI
    Symmetric Key Import2 CSFSYI2
    Symmetric Key Export CSFSYX
    Symmetric MAC Generate CSFSMG
    Symmetric MAC Generate (with ALET) CSFSMG1
    Symmetric MAC Verify CSFSMV
    Symmetric MAC Verify (with ALET) CSFSMV1
    Symmetric Key Export with Data CSFSXD
    Transaction Validation CSFTRV
    Trusted Block Create CSFTBC
    TR-31 Export CSFT31X
    TR-31 Import CSFT31I
    Unique Key Derive CSFUDK
    VISA CVV Service Generate CSFCSG
    VISA VISA CVV Service Verify CSFCSV
    Table 3. Compatibility Service and its Exit Identifier
    Service Exit Identifier
    Encipher under Master Key CSFEMK
    CUSP/PCF GENKEY Service CSFGKC
    CUSP/PCF RETKEY Service CSFRTC
    Cipher/Decipher CSFEDC

    The load module name is the name of the module that contains the exit. The LOAD MODULE column on the panel lists the load module name for each exit. The OPTIONS column on this panel lists the action to occur if the exit fails.

  4. To change the module name or failure option of an exit or add a new exit when viewing this panel, access the installation options data set. In the data set, change how you specified an exit or specify a new exit and restart ICSF.