Step 7. Customizing TKE and loading master keys

If you are not using TKE, proceed to the next step.

Process
TKE Administrator's and Key Officers
  • Define host IDs
  • Define roles
  • Define coprocessor authorities
  • Load new DES master key (optional)
  • Load new RSA master key (optional)
  • Load new AES master key (optional)
  • Load new ECC master key if running on z10 or newer servers with a CCA Crypto Express coprocessor and the Sept. 2011 or later licensed internal code. (optional)
Note: If you have more than one coprocessor, repeat the process for each, unless groups have been defined.
Responsible
ICSF Administrator
  • Initialize CKDS and SET the DES and AES (if applicable) master keys
  • Initialize PKDS and SET the RSA and ECC (if applicable) master keys
  • Enable PKA Callable Services control
    Note: The PKA Callable Services control is disabled if the system has a CEX3C or newer with the Sept. 2011 or newer licensed internal code.
Where
TKE Workstation and ICSF Panels
Verify
In System Log (Systems with Crypto Express coprocessors and accelerators): 
CSFM608I A CKDS KEY STORE POLICY IS NOT DEFINED.               
CSFM608I A PKDS KEY STORE POLICY IS NOT DEFINED.               
CSFM610I GRANULAR KEYLABEL ACCESS CONTROL IS DISABLED.     
CSFM611I XCSFKEY EXPORT CONTROL FOR AES IS DISABLED.       
CSFM611I XCSFKEY EXPORT CONTROL FOR DES IS DISABLED.       
CSFM612I PKA KEY EXTENSIONS CONTROL IS DISABLED.           
CSFM654I KEY ARCHIVING USE CONTROL IS DISABLED.            
CSFM015I FIPS 140 SELF CHECKS FOR PKCS11 SERVICES SUCCESSFUL.                                                             
CSFM111I CRYPTOGRAPHIC FEATURE IS ACTIVE. CRYPTO EXPRESS5 ACCELERATOR 5Axx, SERIAL NUMBER N/A.                                    
CSFM111I CRYPTOGRAPHIC FEATURE IS ACTIVE. CRYPTO EXPRESS5 COPROCESSOR 5Czz, SERIAL NUMBER ssssssss.                               
CSFM133I THERE ARE NO ACTIVE PKCS11 COPROCESSORS.          
CSFM100E CRYPTOGRAPHIC KEY DATA SET, CSF.CSFCKDS IS NOT INITIALIZED.                                                        
CSFM101E PKA KEY DATA SET, CSF.CSFPKDS IS NOT INITIALIZED.                                                            
CSFM126I CRYPTOGRAPHY - FULL CPU-BASED SERVICES ARE AVAILABLE.                                                              
CSFM001I ICSF INITIALIZATION COMPLETE

Message CSFM111I is issued for each active Crypto Express coprocessors and accelerators.

Message CSFM122I will not be issued when your system has any CEX3C or newer coprocessors (with the Sept. 2011 or later LIC) online. The PKA callable services control will not be active. The availability of RSA callable services will depend on the status of the RSA master key. CSFM130I is issued when the RSA master key is active and RSA callable services are available.

In System Log (Systems without coprocessors or accelerators): 
CSFM608I A CKDS KEY STORE POLICY IS NOT DEFINED.
CSFM608I A PKDS KEY STORE POLICY IS NOT DEFINED.
CSFM610I GRANULAR KEYLABEL ACCESS CONTROL IS DISABLED.
CSFM611I XCSFKEY EXPORT CONTROL FOR AES IS DISABLED.
CSFM611I XCSFKEY EXPORT CONTROL FOR DES IS DISABLED.
CSFM612I PKA KEY EXTENSIONS CONTROL IS DISABLED.
CSFM654I KEY ARCHIVING USE CONTROL IS DISABLED.
CSFM015I FIPS 140 SELF CHECKS FOR PKCS11 SERVICES SUCCESSFUL.
CSFM505I CRYPTOGRAPHY - THERE ARE NO ACTIVE CRYPTOGRAPHIC COPROCESSORS.
CSFM131E CRYPTOGRAPHY - DES SERVICES ARE NOT AVAILABLE.
CSFM131E CRYPTOGRAPHY - RSA SERVICES ARE NOT AVAILABLE.
CSFM131E CRYPTOGRAPHY - ECC SERVICES ARE NOT AVAILABLE.
CSFM131E CRYPTOGRAPHY - AES SERVICES ARE NOT AVAILABLE.
CSFM133I THERE ARE NO ACTIVE PKCS11 COPROCESSORS.
CSFM131E CRYPTOGRAPHY - SECURE KEY PKCS11 SERVICES ARE NOT AVAILABLE.
CSFM100E CRYPTOGRAPHIC KEY DATA SET, CSF.CSFCKDS IS NOT INITIALIZED.
CSFM101E PKA KEY DATA SET, CSF.CSFPKDS IS NOT INITIALIZED.
CSFM507I CRYPTOGRAPHY - THERE ARE NO CRYPTOGRAPHIC COPROCESSORS ONLINE.
CSFM508I CRYPTOGRAPHY - THERE ARE NO CRYPTOGRAPHIC ACCELERATORS ONLINE.
CSFM126I CRYPTOGRAPHY - FULL CPU-BASED SERVICES ARE AVAILABLE.
CSFM001I ICSF INITIALIZATION COMPLETE
References

For information on managing master keys, refer to z/OS Cryptographic Services ICSF Administrator's Guide.

Completed