When you invoke the CSFEUTIL program as a batch job, you receive
the return code in a message when the job completes. The meanings
of the return codes are:
- Return Code
- Meaning
- 0
- Process successful.
- 4
- Parameters are incorrect.
- 8
- RACF authorization check failed.
- 12
- Process unsuccessful.
- 68 or 72
- CKDS processing has failed. An error was detected in the new KDS.
- 84 or 116
- CKDS processing encountered an abnormal end while processing a
CKDS. When the return code is 84 the error occurred while processing
the new CKDS. When the return code is 116 the error occurred while
processing the old CKDS. View the SYSTRACE at the time of the error
for an indication of the abend that was encountered.
- 100 or 104
- CKDS processing has failed. An error was detected in the old KDS.
- 101 or 105
- CKDS processing has failed. An error occurred while processing
a KDS record. For a 101 return code, consult the Return Code 8 reason
codes in the z/OS Cryptographic Services ICSF Application Programmer's Guide.
For a 105 return code, consult the Return Code 12 reason codes in
the z/OS Cryptographic Services ICSF Application Programmer's Guide.
When the program is invoked from another program, the invoking
program receives the reason code in General Register 0 along with
the return code in General Register 15. The following list describes
the meaning of the reason codes. If a particular reason code is not
listed, refer to the listing of ICSF and TSS return and reason codes
in the z/OS Cryptographic Services ICSF Application Programmer's Guide.
Return code 0 has these reason codes: - Reason Code
- Meaning
- 36132
- CKDS reencipher/Change MK processed only tokens encrypted under
the DES master key.
- 36136
- CKDS reencipher/Change MK processed only tokens encrypted under
the AES master key.
- 36140
- CKDS reencipher/Change MK processed tokens encrypted under the
DES and AES master key.
Return code 8 has these reason codes: - Reason Code
- Meaning
- 3114
- Another refresh utility request is executing, and this utility
request will not be allowed to run.
- 16000
- Invoker has insufficient RACF access authority to perform function.
Return code 12 has these reason codes: - Reason Code
- Meaning
- 36000
- Unable to change master key. Check hardware status.
- 36020
- Input CKDS is empty or not initialized (authentication pattern
in the control record is invalid).
- 36060
- The new master key register or registers are not full.
- 36068
- The input KDS is not enciphered under the current master key.
- 36084
- The master key register cannot be changed since ICSF is running
in compatibility mode.
- 36104
- Option not available. There were no Cryptographic Coprocessors
available to perform the service that was attempted.
- 36160
- The attempt to reencipher the CKDS failed because there is an
enhanced token in the CKDS.
- 36168
- The LRECL attribute of the input CKDS doesn’t match the
LRECL of the output CKDS.
- 36211
- A request was made to load a key data set (CKDS, PKDS or TKDS)which
has records which are in KDSR format. This level of ICSF does not
support KDSR format records
Return code 72 or 104 has these reason codes: - Reason Code
- Meaning
- 6008
- A service routine has failed.
The service routines that may
be called are:
- CSFMGN
- MAC generation
- CSFMVR
- MAC verification
- CSFMKVR
- Master key verification
- 6012
- The Single-record, read-write installation
exit (CSFSRRW) returned a return code greater than 4.
- 6016
- An I/O error occurred reading or writing the CKDS.
- 6020
- The CSFSRRW installation exit abended and the installation options
EXIT keyword specifies that the invoking service should end.
- 6024
- The CSFSRRW installation exit abended and the installation options
EXIT keyword specifies that ICSF should
end.
- 6028
- The CKDS access routine could not establish the ESTAE environment.
- 6040
- The CSFSRRW installation exit could not be loaded and is required.
- 6044
- Information necessary to set up CSFSRRW installation exit processing
could not be obtained.
- 6048
- The system keys cannot be found while attempting to write a complete
CKDS data set.
- 6052
- For a write CKDS record request, the current master key verification
pattern (MKVP) does not match the CKDS header record MKVP.
- 6056
- The output CKDS is not empty.
- 36001
- A variable-length record format CKDS cannot be used on a system
with a Cryptographic Coprocessor Feature.
- 36168
- The LRECL attribute of the input CKDS doesn’t match the
LRECL of the output CKDS.