A fix is available
APAR status
Closed as new function.
Error description
New Function FIXCAT - SMFREC/K ********************************* The following PTF is in error: UJ99052 HCR77E0 The fixing APAR is OA69220 *********************************
Local fix
Problem summary
**************************************************************** * USERS AFFECTED: ICSF users of HCR77E0 and HCR77F0. * **************************************************************** * PROBLEM DESCRIPTION: New function - support for * * clear key PKCS #11 ICSF FIPS 140-3 * * algorithm checking. * * PKCS #11 Service CSFPPKS requests * * using RSA modulus-exponent (ME) keys * * return the wrong result when the * * modulus size is 1025 to * * 2048 bits, inclusive. * * PKCS #11 Service CSFPSKD requests * * using RULE GCMTLS13 require an input * * clear_text_length that exceeds * * the length of the decrypted text. * **************************************************************** Summary -------------------------------------------------------------- Support for clear key PKCS#11 ICSF FIPS 140-3 algorithm checking. The ICSF FIPSMODE installation option was updated to allow FIPS 140-3 parameter values. The documentation of ICSF FIPSMODE parameter checking was updated to describe FIPS 140-3 modes in the ICSF System Programmer's Guide and ICSF Writing PKCS #11 Applications. The following services were updated with new restrictions: -------------------------------------------------------------- PKA Decrypt (CSNDPKD and CSNFPKD) Digital Signature Generate (CSNDDSG) ICSF Multi-Purpose Service (CSFMPS and CSFMPS6) PKCS #11 Token Record Create (CSFPTRC) The following services were updated: -------------------------------------------------------------- ICSF Query Facility (CSFIQF) ICSF Query Facility2 (CSFIQF2) PKCS #11 Derive Key (CSFPDVK) PKCS #11 Derive Multiple Keys (CSFPDMK) PKCS #11 Generate Key Pair (CSFPGKP) PKCS #11 Generate Keyed Mac (CSFPHMG) PKCS #11 Generate Secret Key (CSFPGSK) PKCS #11 One-Way Hash, Sign, or Verify (CSFPOWH) PKCS #11 Private Key Sign (CSFPPKS) PKCS #11 Pseudo-Random Function (CSFPPRF) PKCS #11 Public Key Verify (CSFPPKV) PKCS #11 Secret Key Decrypt (CSFPSKD) PKCS #11 Secret Key Encrypt (CSFPSKE) PKCS #11 Unwrap Key (CSFPUWK) PKCS #11 Verify Keyed MAC (CSFPHMV) PKCS #11 Wrap Key (CSFPWPK) PKCS #11 Generate Secret Key2 (CSFPGK2) PKCS #11 Private Key Structure Decrypt (CSFPPD2) PKCS #11 Private Key Structure Sign (CSFPPS2) PKCS #11 Public Key Structure Encrypt (CSFPPE2) PKCS #11 Public Key Structure Verify (CSFPPV2) The following service was added: -------------------------------------------------------------- PKCS #11 Pseudo-Random Function2 (CSFPPR2) The following message was added: -------------------------------------------------------------- CSFM140I SECURE KEY PKCS11 SERVICES RESTRICTED BY ICSF FIPSMODE OPTION SETTING. The following SMF type 82 records were updated: ----------------------------------------------------------- PKCS #11 key lifecycle event (Subtype 42) PKCS #11 key usage event (Subtype 46) PKCS #11 no key usage event (Subtype 47) PKCS #11 Service Private key sign (CSFPPKS) has been modified to return the correct value when requests using RSA modulus-exponent (ME) keys are used. PKCS #11 Service Secret Key Decrypt (CSFPSKD) using rule GCMTLS13 has been modified to accept an input clear_text_length value that is equal to or greater than the decrypted text length.
Problem conclusion
Temporary fix
Comments
All the enhancements included in this APAR will be documented in the HCR77F0 release of the following ICSF publications ICSF Overview SC14-7505 ICSF Administrator's Guide SC14-7506 ICSF System Programmer's Guide SC14-7507 ICSF Application Programmer's Guide SC14-7508 ICSF Writing PKCS #11 Applications SC14-7510 ICSF Messages SC14-7509 and in z/OS 3.2 MVS System Codes SA38-0665 Note that users of the HCR77E0 or HCR77F0 releases can use these same publications. ×**** PE26/03/12 FIX IN ERROR. SEE APAR OA69220 FOR DESCRIPTION
APAR Information
APAR number
OA66740
Reported component name
ICSF/MVS
Reported component ID
568505101
Reported release
7E0
Status
CLOSED UR1
PE
NoPE
HIPER
NoHIPER
Special Attention
YesSpecatt / New Function / Xsystem
Submitted date
2024-07-16
Closed date
2026-02-24
Last modified date
2026-04-14
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
UJ99050 UJ99052
Modules/Macros
CSFASPB CSFCCVE CSFCCVT CSFDDOPT CSFDLL31 CSFDLL3X CSFDLL64 CSFENAME CSFENCFG CSFENCFM CSFENCRT CSFGICTF CSFGICVE CSFGICVT CSFGIFLT CSFGIKDS CSFGIKUS CSFGIOPT CSFGISB CSFGISPB CSFGISTK CSFGITKD CSFHDR02 CSFHDR05 CSFHH002 CSFHH005 CSFHL001 CSFHL002 CSFHL003 CSFHX001 CSFHX002 CSFHX003 CSFHX004 CSFHX005 CSFHX006 CSFINIT2 CSFINMTI CSFINPV2 CSFKSNXH CSFKSROP CSFMIKUM CSFMIKUT CSFMIMGM CSFMIOP1 CSFMIOPD CSFMISEC CSFMITSM CSFNCDSG CSFNCIQ2 CSFNCIQF CSFNCPKD CSFPPR2 CSFPPR26 CSFSD001 CSFSD002 CSFSD003 CSFSD004 CSFSD005 CSFSD006 CSFSMFR CSFTCPA0 CSFTCPA1 CSFTCPA2 CSFTCPA3 CSFTCPA4 CSFTCSAF CSFTCSAV CSFTCTR2 CSFTCTRC CSFVCAPC CSFVCAUD CSFZSM82 CSFZTKI CSNPCA3X CSNPCA64 CSNPCAPI CSNPCI3X CSNPCI64 CSNPCINT CSNPCU3X CSNPCU64 CSNPCUTL
| SC147505. | SC147506. | SC147507. | SC147508. | SC147510. |
| SC147509. | SA380665. |
Fix information
Fixed component name
ICSF/MVS
Fixed component ID
568505101
Applicable component levels
Fix is available
Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.
[{"Business Unit":{"code":"BU011","label":"Systems - zSystems software"},"Product":{"code":"SG19O"},"Platform":[{"code":"PF054","label":"z Systems"}],"Version":"7E0"}]
Document Information
Modified date:
15 April 2026