IDCAMS REPRO ENCIPHER DECIPHER with different keys

A user is able to REPRO ENCIPHER a file with one key and REPRO DECIPHER it with a different key with a return code of 0.

//ENCIPHER EXEC PGM=IDCAMS
//CLEAR DD DISP=SHR,DSN=#XFRJS0.IF35SP3.JCL
//CRYPT DD DISP=(NEW,CATLG),DSN=#XFRJS0.TEST.CRYPT,
// SPACE=(CYL,(5,1),RLSE),
// DCB=(RECFM=FB,LRECL=80,BLKSIZE=6160)
//SYSPRINT DD SYSOUT=*
//SYSIN DD *
REPRO -
INFILE(CLEAR) -
OUTFILE(CRYPT) -
ENCIPHER -
(PRIVATEKEY DATAKEYVALUE(ABCD1234) )
/*
//*
//DECIPHER EXEC PGM=IDCAMS
//CRYPT DD DISP=SHR,DSN=#XFRJS0.TEST.CRYPT
//CLEAR DD DISP=(NEW,CATLG),DSN=#XFRJS0.TEST.CLEAR,
// SPACE=(CYL,(5,1),RLSE),
// DCB=(RECFM=FB,LRECL=80,BLKSIZE=6160)
//SYSPRINT DD SYSOUT=*
//SYSIN DD *
REPRO -
INFILE(CRYPT) -
OUTFILE(CLEAR) -
DECIPHER (DATAKEYVALUE(ABCD1224) )
/*

Resolution

From a DES crypto standpoint, ABCD1234 is the same as ABCD1224. With the change, only the parity is adjusted for that byte. And cryptographically, parity is ignored.

IDCAMS will not return an error message if a different key is provided on the DECIPHER. Data is returned, but it may be wrong data. Run IEBCOMPR against the original unencrypted source data set comparing it against the result of the DECIPHER to verify the data is the same.

The real issue is that a simple weak key with all characters is being used. For more information about keys and crypto, refer to: