Performing a coordinated CKDS master key change

The coordinated KDS change master key option simplifies the procedure for changing symmetric master keys. All systems must be running ICSF FMID HCR7790 or later. Before using this procedure, make sure that your system meets all the requirements outlined in Symmetric Master Keys and the CKDS. If your system does not meet these requirements, do not use this procedure. Instead, use the procedure described in Steps for reenciphering the CKDS and performing a single-system CKDS master key change.

Notes:

Coordinated CKDS change master key is not supported on the IBM zSeries 900. In a sysplex environment, the master key will be changed for all systems in the sysplex that share the active CKDS. None of these systems can be an IBM zSeries 900.
The coordinated KDS reencipher procedure offers further advantages in a sysplex environment. Specifically, a master key change initiated from one ICSF instance in the sysplex will change the master key(s) for all ICSF instances in the sysplex that share the same active CKDS. The instructions that follow assume you are running on a single system. If you are running in sysplex environment, make sure you also understand the information in Changing symmetric master keys and refreshing the CKDS when the CKDS is shared in a sysplex environment before proceeding.
Reenciphering a large CKDS (millions of records) may cause a temporary internal suspension of CKDS update requests running in parallel. If you cannot tolerate a temporary suspension in your workload, and would prefer that update requests are failed instead of suspended, you should disallow dynamic CKDS access prior to performing the coordinated CKDS reencipher. For more information, refer to Steps for disallowing dynamic CKDS updates during CKDS administration updates.
This procedure is only for reenciphering the active CKDS. It is not for reencipherring archived or backup copies of the CKDS that are not currently active.
If you have a combination of PCIXCCs, CEX2Cs, and/or CEX3Cs installed in a sysplex environment, the ICSF instance configured with the cryptographic coprocessor containing the highest level of licensed internal code must initiate the coordinated CKDS change master key. If the coordinated CKDS change master key is not initiated by the ICSF instance containing the highest level of licensed internal code, the operation will fail.
If your system is using multiple coprocessors, they must have the same master key(s). When you change the master key(s) in one coprocessor, you should change the master key(s) in the other coprocessors. Therefore, to reencipher a CKDS under a new master key, the new master key registers in all coprocessors must contain the same value.
If the CKDS contains HMAC keys, it must be reenciphered on a system with a CEX3C and the Sept. 2010 or later licensed internal code.
If the CKDS contains variable-length AES keys, it must be reenciphered on a system with a CEX3C and the Sep. 2011 or later licensed internal code.
If there is a problem reenciphering a CKDS entry, the CSFC0316 message is generated specifying the label for the CKDS problem entry.

For more information about defining a CKDS, see the z/OS Cryptographic Services ICSF System Programmer’s Guide.

CSFMKM10 ---------------- ICSF - Master Key Management ---------------- OPTION ===> 9 Enter the number of the desired option. 1 INIT/REFRESH/UPDATE CKDS - Initialize a Cryptographic Key Data Set or activate an updated Cryptographic Key Data Set 2 SET MK - Set a master key (AES, DES, ECC) 3 REENCIPHER CKDS - Reencipher the CKDS prior to changing a symmetric master key 4 CHANGE SYM MK - Change a symmetric master key and activate the reenciphered CKDS 5 INIT/REFRESH/UPDATE PKDS - Initialize a Public Key Data Set or activate an updated Public Key Data Set or update the Public Key Data Set header 6 REENCIPHER PKDS - Reencipher the PKDS 7 CHANGE ASYM MK - Change an asymmetric master key and activate the reenciphered PKDS 8 COORDINATED KDS REFRESH - Perform a coordinated KDS refresh 9 COORDINATED KDS CHANGE MK - Perform a coordinated KDS change master key

------------------- ICSF - Coordinated KDS change master key ------------------ To perform a coordinated KDS change master key, enter the KDS names below and optionally select the rename option. KDS Type ===> CKDS Active KDS ===> 'PLEX.TEST.CKDS' New KDS ===> Rename Active to Archived and New to Active (Y/N) ===> N Archived KDS ===> Create a backup of the reenciphered KDS (Y/N) ===> N Backup KDS ===> Press ENTER to perform a coordinated KDS change master key. Press END to exit to the previous menu.