When you enter or change the RSA-MK, you must first disable the PKA callable services control. This requirement applies only to the RSA-MK. You do not need to disable PKA callable services control in order to enter or change the ECC-MK.

1. Access the administrative control functions by choosing option 4, ADMINCNTL, on the Primary Menu panel, as shown in Figure 113.
   Figure 113. Selecting Administrative Control on the ICSF Primary Menu Panel

    CSF@PRIM --------- Integrated Cryptographic Service Facility -------
    OPTION ===> 4
   
    Enter the number of the desired option.
   
      1  COPROCESSOR MGMT    -  Management of Cryptographic Coprocessors
      2  MASTER KEY MGMT     -  Master key set or change, CKDS/PKDS processing
      3  OPSTAT              -  Installation options
      4  ADMINCNTL           -  Administrative Control Functions
      5  UTILITY             -  ICSF Utilities
      6  PPINIT              -  Pass Phrase Master Key/KDS Initialization
      7  TKE                 -  TKE Master and Operational key processing
      8  KGUP                -  Key Generator Utility processes
      9  UDX MGMT            -  Management of User Defined Extensions
   
   
          Licensed Materials - Property of IBM
   
         5694-A01 (C) Copyright IBM Corp. 1990, 2011. All rights reserved.
         US Government Users Restricted Rights - Use, duplication or
         disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
   
    Press ENTER to go to the selected option.
    Press END   to exit to the previous menu.
    

   The Administrative Control Function panel appears. See Figure 114.

   Figure 114. Enabling and Disabling the PKA Callable Services

    CSFACF00 ------------- ICSF Administrative Control Functions
    COMMAND ===>
             Active CKDS: CRYPTO25.HCRICSF.CKDS
             Active PKDS: CRYPTO25.HCRICSF.PKDS
             Active TKDS: CRYPTO25.HCRICSF.TKDS
   
   To change the status of a control, enter the appropriate character
   (E - ENABLE, D - DISABLE) and press ENTER.
   
            Function                                 STATUS
            --------                                 ------
    .  Dynamic CKDS Access                           ENABLED 
    .  PKA Callable Services                         ENABLED  
    .  Dynamic PKDS Access                           ENABLED
      

2. Enter the appropriate character and press ENTER.
   • To enable the PKA callable services control, enter an 'E' before the PKA Callable Services function.
   • To disable the PKA callable services control, enter a 'D' before the PKA Callable Services function.
   • To enable the dynamic PKCS update services control, enter an ‘E' before the Dynamic PKDS Access function.
   • To disable the dynamic PKCS update services control, enter a ‘D' before the Dynamic PKDS Access function.