Guideline: Use the DES algorithm, because it provides better security than the masking algorithm.

To use the masking algorithm, activate the ICHDEX01 exit that is shipped with RACF® in SYS1.LINKLIB, or write your own ICHDEX01 exit (in the link pack area) that sets the return code to 4. For more information, see Password authentication exits.

In addition, you must provide an ICHDEX11 exit that performs function equivalent to the ICHDEX01 exit. Write your own ICHDEX11 exit (in the link pack area) that sets the return code to 4. See Password authentication exits.