Entering master keys

The types of master keys you can enter and the steps you take to enter master keys depend on your system processor and hardware features.

The following methods may be used to enter master keys:

Pass phrase initialization
The pass phrase initialization utility allows the user of ICSF to set all of the CCA master keys available on their systems and initialize the CKDS and PKDS. For steps in using the pass phrase initialization utility, see Using the pass phrase initialization utility.
Master Key Entry panels
The Master Key Entry panels are enhanced ISPF panels enabling you to enter master key parts in the clear. Use these panels to enter master key parts into CCA coprocessors. The master key parts appear briefly in the clear in MVS host storage within the address space of the TSO user before being transferred to the secure hardware. Within the boundaries of the secure hardware, the key parts are combined to produce the master key. The master key part entry panels provide a level of security for master key entry that is superior to that provided with PCF. Master key part entry is provided for installations where the security requirements do not warrant the additional expense of the optional TKE workstation. For master key entry steps on the coprocessors, see Managing CCA Master Keys.
Trusted Key Entry (TKE) workstation
The TKE workstation is an optional hardware feature. The TKE workstation uses a variety of public key cryptographic techniques to ensure both the integrity and privacy of the logically secure master key transfer channel. You can use a single TKE workstation to set up master keys in all CCA and EP11 coprocessors within a server complex.
- TKE must be used to enter P11 master keys on a PKCS #11 cryptographic coprocessor.
For information on using the TKE workstation, see z/OS Cryptographic Services ICSF TKE Workstation User's Guide.

Servers or processor models may have multiple cryptographic coprocessors. The master keys must be the same for all coprocessors accessed by the same operating system.

When you have entered symmetric master keys, go to the CKDS Master Key Management panel to:

Create the CKDS header record.
Activate the DES master key and/or AES master key and read the CKDS into storage.
Create system keys that ICSF uses for internal processing and read the CKDS into storage again.

When you have entered the asymmetric master keys, go to the PKDS Master Key Management panel to initialize the PKDS. This process will:

Create the PKDS header record.
Activate the RSA master key and/or the ECC master key and read that PKDS into storage.

When you have entered the P11 master keys, select option 1 from the ICSF TKDS Master Key Management panel to initialize the TKDS. This process will:

Create the TKDS header record.
Activate the P11 master key.