OA58359: USING AES CIPHER KEYS WITH THE XPRTCPAC ATTRIBUTE MAY FAIL WITH RETURN 8 REASON CODE '2F'X

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• If you attempt to use an AES CIPHER key with the XPRTCPAC
  attribute in ICSF services while a Crypto Express5 Coprocessor
  (CEX5C) is active, the request may fail with return code 8
  reason code 47 ('2F'x).
  If the XPRTCPAC keyword is used in the TR-31 Import callable
  service (CSNBT31I/CSNET31I)  while a Crypto Express5 Coprocessor
  (CEX5C) is active, the request may fail with return code 8
  reason code 2016 ('7E0'x).
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * HCR77C1 and later: Users of AES CIPHER keys with the         *
  * XPRTCPAC attribute.                                          *
  * HCR77D0 and later: Users of the TR-31 Import callable        *
  * service (CSNBT31I/CSNET31I) with the XPRTCPAC keyword.       *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * HCR77C1 and later: When a Crypto Express5 CCA coprocessor    *
  * (CEX5C) is available, requests to use an AES CIPHER key with *
  * the XPRTCPAC attribute may fail with return code 8, reason   *
  * code 47 ('2F'x).                                             *
  * HCR77D0 and later: When a CEX5C is available and the         *
  * XPRTCPAC keyword is used on the TR-31 Import callable        *
  * service (CSNBT31I/CSNET31I), the request may fail with       *
  * return code 8, reason code 2016 ('7E0'x).                    *
  *                                                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  PROBLEM SUMMARY:
  ----------------
  HCR77C1 and later: AES CIPHER keys with the XPRTCPAC attribute
  can only be used on a CEX6C or later coprocessor. ICSF sometimes
  routes these keys to a CEX5C.
  HCR77D0 and later: TR-31 Import callable service
  (CSNBT31I/CSNET31I) requests containing the XPRTCPAC keyword can
  only be processed on a CEX6C or later coprocessor. ICSF
  sometimes routes these requests to a CEX5C.
  

Problem conclusion

• ****************************************************************
  PROBLEM CONCLUSION:
  -------------------
  HCR77C1 and later: When only a CEX5C is available, requests to
  use an AES CIPHER key with the XPRTCPAC attribute will fail with
  return code 12 ('C'x), reason code 11060 ('2B34'x). When a CEX6C
  or later coprocessor is available, requests to use an AES CIPHER
  key with the XPRTCPAC attribute will be sent to a CEX6C or later
  coprocessor.
  
  HCR77D0 and later: When only a CEX5C is available, TR-31 Import
  callable service requests containing the XPRTCPAC keyword will
  fail with return code 12 ('C'x), reason code 11060 ('2B34'x).
  When a CEX6C or later coprocessor is available, TR-31 Import
  callable service requests containing the XPRTCPAC keyword will
  be sent to a CEX6C or later coprocessor.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UJ01401 UJ01402 UJ01403

Modules/Macros

• CSFASPB  CSFNCPRB CSFENGSP CSFGISPB CSFNCT3I
  

Fix information

• Fixed component name

  ICSF/MVS

• Fixed component ID

  568505101

Applicable component levels

• R7C1 PSY UJ01401

     UP19/11/16 P F911

• R7D1 PSY UJ01403

     UP19/11/16 P F911

• R7D0 PSY UJ01402

     UP19/11/16 P F911

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.