Unless you have a TKE, you will have to use the ICSF panels to enter the
master keys. So yes, you'll need to IPL each image to do so. Just a
heads up that if you perform ICSF Master Key changes (recommended), you
might have to first enter the previous set of keys, then the current
set. I can elaborate on why if you'd like.
Mark Jacobs
Jesse 1 Robinson <mailto:[email protected]>
October 19, 2016 at 11:41 AM
We are installing a z13s and going through preliminary setup. When
selecting the Crypto tab in an Image profile, I was a bit alarmed by
this message:
Attention: You must install the 'IBM CP Assist for Cryptographic
Functions'
(CPACF) feature if a cryptographic candidate is selected from the list
box.
Otherwise, some functions of Integrated Cryptographic Service Facility
(ICSF) may fail.
I spoke to the person who created and placed the order. He assured me
that CPACF had been ordered and that no one he talked to believed that
it requires explicit 'activation'. So I went to a z12 that has been in
service for years. I see the same warning message on the Crypto tab.
So it appears to be standard boilerplate that does not reflect the
status of CPACF.
We’re still exploring how to set the Master Key. We had thought that
it was an HCM task, but now we're led to believe that it's done
through ICSF. Which means that we have to IPL (each?) LPAR in order to
set it. The guy who did this for years is gone.
.
.
J.O.Skip Robinson
Southern California Edison Company
Electric Dragon Team Paddler
SHARE MVS Program Co-Manager
323-715-0595 Mobile
626-302-7535 Office
[email protected]
-----Original Message-----
From: IBM Mainframe Discussion List [mailto:[email protected]]
On Behalf Of Kirk Wolf
Sent: Wednesday, October 19, 2016 8:20 AM
To: [email protected]
Subject: (External):Re: Implementing ICSF - FOTS1949 PRNG is not seeded
Right. I've never seen this particular error caused by a missing CPACF
feature.
More likely either ICSF is not started or the correct userids do not
have access to the necessary ICSF features via SAF/RACF.
Kirk Wolf
Dovetailed Technologies
http://dovetail.com
On Wed, Oct 19, 2016 at 10:13 AM, R.S. <[email protected]>
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
Please be alert for any emails that may ask you for login information
or directs you to login via a link. If you believe this message is a
phish or aren't sure whether this message is trustworthy, please send
the original message as an attachment to '[email protected]'.
--
Mark Jacobs
Time Customer Service
Global Technology Services
The standard you walk past is the standard you accept.
Lt. Gen. David Morrison
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [email protected] with the message: INFO IBM-MAIN
