z/OS Cryptographic Services ICSF System Programmer's Guide
Previous topic | Next topic | Contents | Index | Contact z/OS | Library | PDF


Installing the exits

z/OS Cryptographic Services ICSF System Programmer's Guide
SA22-7520-17

You install an exit for a service by installing the load module that contains the exit into an APF-authorized library. ICSF uses this normal search order to locate the exit:

  • Job pack area
  • Steplib (if one exists)
  • Link pack area (LPA)
  • Link list (SYS1.LINKLIB concatenation)

Define the ICSF name and the load module name as a value on the EXIT keyword in the installation options data set. For more information about the installation options data set, see Parameters in the installation options data set. The EXIT keyword has this syntax:

  • EXIT ( ICSF name, load module name, FAIL (options) )

The ICSF name portion of the keyword refers to the ICSF name for each service exit. Note that the ICSF name for each service exit is the same as its name. Table 14 lists the ICSF names for each of the service exits. Table 15 lists the ICSF names for each of the compatibility service exits. The load module name is the name of the load module that contains the exit. The name can be any valid name that your installation chooses. The FAIL portion of the EXIT keyword specifies the action ICSF takes if the exit cannot be loaded or it ends abnormally. The valid FAIL options are:

NONE
No action is taken. The exit can be called again and will end abnormally again.
EXIT
The exit is no longer available to be called again.
SERVICE
The service or program that called the exit is no longer available to be called again.
ICSF
ICSF or the key generator utility program or the PCF conversion program is ended, depending on the exit.

You must specify a FAIL option. If you do not, ICSF returns an error message, ends abnormally, and generates an SVC dump when attempting to load the exit. If the exit ends abnormally, the service call fails regardless of the fail option you specified. Fail options apply only to subsequent requests for the service.

Note:
In this table, CSFPKSC (PKSC interface) and CSFPCI (PCI interface), are a part of the product-sensitive programming interface.
Table 14. Services and Their ICSF Names
ServiceICSF Name
ANSI X9.17 EDC GenerateCSFAEGN
ANSI X9.17 Key ExportCSFAKEX
ANSI X9.17 Key ImportCSFAKIM
ANSI X9.17 Key TranslateCSFAKTR
ANSI X9.17 Transport Key Partial NotarizeCSFATKN
Ciphertext TranslateCSFCTT
Ciphertext Translate (with ALET)CSFCTT1
CKDS Key Record CreateCSFKRC
CKDS Key Record Create2CSFKRC2
CKDS Key Record DeleteCSFKRD
CKDS Key Record ReadCSFKRR
CKDS Key Record Read2CSFKRR2
CKDS Key Record WriteCSFKRW
CKDS Key Record Write2CSFKRW2
Clear Key ImportCSFCKI
Clear PIN EncryptCSFCPE
Clear PIN GenerateCSFPGN
Clear PIN Generate AlternateCSFCPA
Control Vector TranslateCSFCVT
Coordinated KDS AdministrationCSFCRC
Cryptographic Variable EncipherCSFCVE
CVV Key CombineCSFCKC
Data Key ExportCSFDKX
Data Key ImportCSFDKM
DecipherCSFDEC
Decipher (with ALET)CSFDEC1
DecodeCSFDCO
Digital Signature GenerateCSFDSG
Digital Signature VerifyCSFDSV
Diversified Key GenerateCSFDKG
ECC Diffie-HellmanCSFEDH
EncipherCSFENC
Encipher (with ALET)CSFENC1
EncodeCSFECO
Encrypted PIN GenerateCSFEPG
Encrypted PIN TranslateCSFPTR
Encrypted PIN VerifyCSFPVR
HMAC GenerateCSFHMG
HMAC VerifyCSFHMV
Key ExportCSFKEX
Key GenerateCSFKGN
Key Generate2CSFKGN2
Key ImportCSFKIM
Key Part ImportCSFKPI
Key Part Import2CSFKPI2
Key TestCSFKYT
Key Test2CSFKYT2
Key Test ExtendedCSFKYTX
Key TranslateCSFKTR
Key Translate2CSFKTR2
MAC GenerateCSFMGN
MAC Generate (with ALET)CSFMGN1
MAC VerifyCSFMVR
MAC Verify (with ALET)CSFMVR1
MDC GenerateCSFMDG
MDC Generate (with ALET)CSFMDG1
Multiple Clear Key ImportCSFCKM
Multiple Secure Key ImportCSFSKM
One Way Hash GenerateCSFOWH
One Way Hash Generate (with ALET)CSFOWH1
PCI InterfaceCSFPCI
PIN change/unblockCSFPCU
PKA DecryptCSFPKD
PKA EncryptCSFPKE
PKA Key GenerateCSFPKG
PKA Key ImportCSFPKI
PKA Key TranslateCSFPKT
PKA Key Token ChangeCSFPKTC
PKA Public Key ExtractCSFPKX
PKDS Key Record CreateCSFPKRC
PKDS Key Record DeleteCSFPKRD
PKDS Key Record ReadCSFPKRR
PKDS Key Record WriteCSFPKRW
PKSC InterfaceCSFPKSC
Prohibit ExportCSFPEX
Prohibit Export ExtendedCSFPEXX
Random Number GenerateCSFRNG
Random Number Generate LongCSFRNGL
Remote Key ExportCSFRKX
Restrict Key AttributeCSFRKA
Retained Key DeleteCSFRKD
Retained Key ListCSFRKL
Secure Key ImportCSFSKI
Secure Key Import2CSFSKI2
Secure Messaging for KeysCSFSKY
Secure Messaging for PINsCSFSPN
SET Block ComposeCSFSBC
SET Block DecomposeCSFSBD
Symmetric Key ExportCSFSYX
Symmetric Key GenerateCSFSYG
Symmetric Key ImportCSFSYI
Symmetric Key Import2CSFSYI2
Symmetric MAC GenerateCSFSMG
Symmetric MAC Generate (with ALET)CSFSMG1
Symmetric MAC VerifyCSFSMV
Symmetric MAC Verify (with ALET)CSFSMV1
TR-31 ExportCSFT31X
TR-31 ImportCSFT31I
Transaction ValidationCSFTRV
Transform CDMF KeyCSFTCK
Trusted Block CreateCSFTBC
User Derived KeyCSFUDK
VISA CVV Service GenerateCSFCSG
VISA CVV Service VerifyCSFCSV
Notes:
  1. The alias for the ANSI X9.17 key management services is CSNAxxx.
  2. The aliases for the PKA services is CSNDxxx or or CSNFxxx.
  3. The aliases for the symmetric key services are CSNBxxx or CSNExxx.
Table 15. Compatibility Services and Their ICSF Names
Compatibility ServiceICSF Name
Encipher under Master KeyCSFEMK
Generate a keyCSFGKC
Import a keyCSFRTC
Cipher/DecipherCSFEDC

Go to the previous page Go to the next page




Copyright IBM Corporation 1990, 2014