The key generate callable service generates a single key or a pair of keys. Unlike KGUP, the key generate callable service does not store the keys in the CKDS but returns them to the application program that called the service. The application program can then call the dynamic CKDS update service to store the keys in the CKDS.

When you call the key generate callable service, you pass parameters that specify information about the key you want generated. The key generate callable service generates keys in these possible forms:

• Operational, if the master key protects it
• Importable, if an importer key-encrypting key protects it
• Exportable, if an exporter key-encrypting key protects it

Use of this callable service is optional and should be enabled as required for authorized usage. Enabling this callable service is not recommended for production and usage requires special consideration.

For more information about the key generate callable service, see z/OS Cryptographic Services ICSF Application Programmer’s Guide.