PI83626: SECURE KEY SUPPORT FOR DECENAA1 AND PERFORMANCE IMPROVEMENT FOR DECENBB1

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Support secure keys for exit DECENAA1 when the ICSF protected
  key read facility is available.
  Reduce encryption/decryption processing overhead for exit
  DECENBB1 by exploiting the CPACF KMF instruction when it and
  the ICSF protected key read facility are both available.  Batch
  ICSF CHECKAUTH reoccurring bypass processing will only occur
  when the KMF instruction is being exploited by the exit.
  Additionally, this APAR addresses the following:
   The DECENBI0 Module has been updated to resolve an
  inconsistency in the error reason code, which is used by
  DECENBI0 for a wrong length output field.
   The SAMPLIB Member, DECIMSCB, was updated in the Comments
  section. Encapsulated the retrieval of a CPACF encrypted key in
  a secure routine.  When retrieving a clear key an unencrypted
  version of the clear key will never exist in user key storage.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users.                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: Secure key support for DECENAA1 and     *
  *                      performance improvement for DECENBB1    *
  *                      (PI83626)                               *
  *                      Support secure keys for exit DECENAA1   *
  *                      when the ICSF protected key read        *
  *                      facility is available.                  *
  *                      Reduce encryption/decryption processing *
  *                      overhead for exit DECENBB1 by           *
  *                      exploiting the CPACF KMF instruction    *
  *                      when it and the ICSF protected key read *
  *                      facility are both available. Batch ICSF *
  *                      CHECKAUTH reoccurring bypass processing *
  *                      will only occur when the KMF            *
  *                      instruction is being exploited by the   *
  *                      exit.                                   *
  *                      Encapsulated the retrieval of a CPACF   *
  *                      encrypted key in a secure routine. When *
  *                      retrieving a clear key an unencrypted   *
  *                      version of the clear key will never     *
  *                      exist in user key storage.              *
  *                      Note: The ICSF protected key read       *
  *                      facility is available with ICSF 2.1 and *
  *                      the PTF for APAR OA50450, or any later  *
  *                      release of ICSF.                        *
  *                      Note: The CPACF KMF instruction is      *
  *                      available on the z196, and later,       *
  *                      family of processors.                   *
  *                      Additionally, this APAR addresses the   *
  *                      following:                              *
  *                      The DECENBI0 Module has been updated    *
  *                      to resolve an inconsistency in the      *
  *                      error reason code, which is used by     *
  *                      DECENBI0 for a wrong length output      *
  *                      field. The SAMPLIB Member, DECIMSCB,    *
  *                      was updated in the Comments section     *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI50628

Modules/Macros

• DECENAA1 DECENBB1 DECENBI0 DECF0005 DECIMSCB
  DECSSI20 DECSSI21 H29F120J
  

Fix information

• Fixed component name

  DATA ENCRYPTION

• Fixed component ID

  5655P0300

Applicable component levels

• R120 PSY UI50628

     UP17/10/05 P F710

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.