You can use certain services to manage keys on ICSF. A service can access a key in the in-storage CKDS by specifying a key label. For more information about the services, see z/OS Cryptographic Services ICSF Application Programmer’s Guide.

When a service requests a record from the in-storage CKDS by label, ICSF calls the CKDS entry retrieval exit. For instance, you can use this exit to perform a specific search of the installation data field in the record. See Cryptographic key data set entry retrieval installation exit for more information about the CKDS entry retrieval exit.