R.S, thanks for the clarification. I was confusing control domains and usage domains. We setup all our production lpars to be able to control all domains assigned to production lpars. But as you state, each lpar has a unique usage domain assigned.
And then that’s where TKE comes in. I can load master key to multiple domains at once from a single lpar for all the control domains assigned to that lpar. Sorry to provide inaccurate information. _________________________________________________________________ Dave Jousma Assistant Vice President, Mainframe Engineering [email protected] 1830 East Paris, Grand Rapids, MI 49546 MD RSCB2H p 616.653.8429 f 616.653.2717 -----Original Message----- From: IBM Mainframe Discussion List [mailto:[email protected]] On Behalf Of R.S. Sent: Friday, January 11, 2013 9:45 AM To: [email protected] Subject: Re: ICSF Master Key Management: TKE verus TSO Panels W dniu 2013-01-11 15:23, Jousma, David pisze: > We do use TKE, but I don’t think it matters for this conversation. > But, correct me if I am wrong. We don’t assign a unique crypto > domain per lpar. We have unique domains by environment for TECH, > DEV and PROD environments. So the requirement for us is to load keys > for each environment only per CPC. All lpars that share the same > domain on the same CPC only need to be done on ONE of the systems. > > Even with a TKE, we still have to go into the ICSF dialogs and do the > SET MK function, again, once per crypto domain, per CPC. > > If you assign unique domain to every lpar, then yes, you have to logon > to each and every lpar. Excuse me, are you sure that you are sharing crypto domains between LPARs? AFAIK it is simply impossible. Precisely, it is impossible to use the same domain number for the same crypto engine for different concurrently active LPARs. What is possible: - to share domain number between LPAR1 and LPAR2, but only one of them is activated - share domain number, between LPAR1 and LPAR2 which are concurrently active, but LPAR1 use CryptoEngine 1, while LPAR2 use CryptoEngine 2. - the LPARs reside on different CPCs. IMHO the most typical case is all LPARs use all crypto engines and all are (can be) active at the same time. In such scenario domains have to be unique. BTW: It is possible to assign more than 1 domain to a given LPAR, but z/OS (ICSF) can use one at a time. Change requires ICSF recycle. Regards -- Radoslaw Skorupka Lodz, Poland -- Treść tej wiadomości może zawierać informacje prawnie chronione Banku przeznaczone wyłącznie do użytku służbowego adresata. Odbiorcą może być jedynie jej adresat z wyłączeniem dostępu osób trzecich. Jeżeli nie jesteś adresatem niniejszej wiadomości lub pracownikiem upoważnionym do jej przekazania adresatowi, informujemy, że jej rozpowszechnianie, kopiowanie, rozprowadzanie lub inne działanie o podobnym charakterze jest prawnie zabronione i może być karalne. Jeżeli otrzymałeś tę wiadomość omyłkowo, prosimy niezwłocznie zawiadomić nadawcę wysyłając odpowiedź oraz trwale usunąć tę wiadomość włączając w to wszelkie jej kopie wydrukowane lub zapisane na dysku. This e-mail may contain legally privileged information of the Bank and is intended solely for business use of the addressee. This e-mail may only be received by the addressee and may not be disclosed to any third parties. If you are not the intended addressee of this e-mail or the employee authorised to forward it to the addressee, be advised that any dissemination, copying, distribution or any other similar activity is legally prohibited and may be punishable. If you received this e-mail by mistake please advise the sender immediately by using the reply facility in your e-mail software and delete permanently this e-mail including any copies of it either printed or saved to hard drive. BRE Bank SA, 00-950 Warszawa, ul. Senatorska 18, tel. +48 (22) 829 00 00, fax +48 (22) 829 00 33, www.brebank.pl, e-mail: [email protected] Sąd Rejonowy dla m. st. Warszawy XII Wydział Gospodarczy Krajowego Rejestru Sądowego, nr rejestru przedsiębiorców KRS 0000025237, NIP: 526-021-50-88. Według stanu na dzień 01.01.2013 r. kapitał zakładowy BRE Banku SA (w całości wpłacony) wynosi 168.555.904 złotych. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN This e-mail transmission contains information that is confidential and may be privileged. It is intended only for the addressee(s) named above. If you receive this e-mail in error, please do not read, copy or disseminate it in any manner. If you are not the intended recipient, any disclosure, copying, distribution or use of the contents of this information is prohibited. Please reply to the message immediately by informing the sender that the message was misdirected. After replying, please erase it from your computer system. Your assistance in correcting this error is appreciated. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
