With a PCIXCC, CEX2C, or CEX3C, you can write NOCV keys to the CKDS without being in supervisor state.

Secure AES tokens in the CKDS can only be overwritten by a secure AES token encrypted under the same AES master keys. The same is true for secure DES tokens.

DES tokens cannot be overwritten by an AES token. AES tokens cannot be overwritten by a DES token.

Secure key tokens cannot be processed when the master key is not loaded.

Clear AES and DES tokens can be processed on a system without a cryptographic coprocessor or accelerator.

This table lists the required cryptographic hardware for each server type and describes restrictions for this callable service.

Table 250. CKDS record write required hardware

Server	Required cryptographic hardware	Restrictions
IBM zSeries 900	None.
IBM zSeries 990 IBM zSeries 890	None.
IBM System z9 EC IBM System z9 BC	None.