OA42606: SYMMETRIC KEY ENCIPHER (CSNBSYE) FAILS WITH RETURN CODE 8 REASON CODE 2036 (X'7F4')

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When calling CSNBSYE on a Z990, the second call fails with
  RC=8 and RSN=2036.
  
  The first call had rules of  AES CFB KEYIDENT INITIAL
  and that call worked fine.
  The second call had rules of AES CFB KEYIDENT CONTINUE
  and that failed with rc=8,2036.
  
  CSNBSYE works fine when only 1 call is made using the rules
  of AES CFB KEYIDENT ONLY
  

Local fix

• Call CSNBSYE with the RULE of ONLY and pass all of the data to
  be encrypted instead of making multiple SYE calls.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: Callers of Symmetric Key Encipher or         *
  *                 Symmetric Key Decipher using one of the      *
  *                 following Processing Rules: CBC-CS, CFB,     *
  *                 CFB-LCFB, or OFB.                            *
  ****************************************************************
  * PROBLEM DESCRIPTION: Symmetric Key Encipher (CSNBSYE or      *
  *                      CSNBSYE1) or Symmetric Key Decipher     *
  *                      (CSNBSYD or CSNBSYD1) when called with  *
  *                      one of the Processing Rules CBC-CS,     *
  *                      CFB, CFB-LCFB, or OFB and ICV Selection *
  *                      rule of either CONTINUE or FINAL will   *
  *                      receive return code 8,                  *
  *                      reason code 2036 (x'7F4') indicating    *
  *                      incorrect chain_data. On z990/z890 and  *
  *                      previous hardware, all AES key sizes    *
  *                      are impacted. On z9, only AES-192 and   *
  *                      AES-256 are impacted. System z10 and    *
  *                      later are not impacted.                 *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Problem Summary
  ----------------------------------------------------------------
  Symmetric Key Encipher (CSNBSYE) and Symmetric Key Decipher
  (CSNBSYD) incorrectly update the chain_data parameter for the
  Processing Rules CBC-CS, CFB, CFB-LCFB, or OFB when ICV
  Selection rule INITIAL is used, which causes the following call
  with an ICV Selection rule of CONTINUE or FINAL to incorrectly
  fail with an indication of incorrect chain_data.
  
  D/T2064
  D/T2066
  D/T2084
  D/T2086
  D/T2094
  D/T2096
  

Problem conclusion

• Symmetric Key Encipher (CSNBSYE) and Symmetric Key Decipher
  (CSNBSYD) have been changed to correctly update the chain_data
  parameter for the Processing Rules CBC-CS, CFB, CFB-LCFB, or OFB
  when ICV Selection rule INITIAL is used.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UA70003 UA70004 UA70005

Modules/Macros

• CSFINPV2
  

Fix information

• Fixed component name

  ICSF/MVS

• Fixed component ID

  568505101

Applicable component levels

• R7A0 PSY UA70003

     UP13/07/24 P F307

• R780 PSY UA70004

     UP13/07/24 P F307

• R790 PSY UA70005

     UP13/07/24 P F307

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.