On Wednesday, 06/13/2007 at 09:31 AST, Michael Coffin <[EMAIL PROTECTED]> wrote: > Hi Alan, > > I wish it were that simple, but aren't there Windows based "key-servers" > involved that hold the keys? One of my concerns is replicating the > contents of those Winblows "key servers" (somehow) to your DR site. > Maybe you can answer this for me, if you have your encrypted tapes but > no key-servers, is there a way (from a 3270 console) to provide a > "master key/passphrase" or something to make the tapes usable/readable?
(I addressed the supported EKM platforms in my previous post.) A few things to understand: a. Every tape is encrypted with a randomly generated AES key. b. The key that was used to encrypt the tape is stored ONLY on the tape, not the keystore. c. The key stored on the tape is itself encrypted (wrapped) with the PUBLIC KEY associated with the drive. d. The paired PRIVATE key is required to decrypt the stored AES key e. The host (CP's ATTACH command) binds the public/private keypair to the drive f. The tape can record TWO encrypted AES keys With that in mind, there are four ways to handle DR (this is all discussed in the EKM book under "Disaster Recovery Site Considerations): 1. Duplicate your own EKM at the DR site. Just run it in a Linux guest. In fact, your Linux guest could be the alternate EKM for your home site. (If memory serves, the control unit allows configuration of more than one EKM.) 2. Export your keys from your EKM and install them on the DR provider's EKM. 3. Import the DR provider's own public key into YOUR EKM. Specify BOTH your key AND the DR provider's key on the ATTACH. 4. Generate another keypair for the DR site. Specify BOTH your "regular" key AND your DR key on the the ATTACH. Export only the DR keypair from your EKM and import it into the DR provider's EKM. Personally, I like #3 or #4. That keeps your "normal" private keys out of others' hands. > By the way, what software is required on z/VM? I see lot's of > references in the doc to RACF (which we don't use), but can't tell if > that's required for this to work or not. I had access to a TS1120 > recently, but couldn't test it because z/VM 5.3 is the first release to > support the drive, and that doesn't go GA for a couple of weeks yet. Not strictly true. There is an SPE to z/VM 5.2 that allows use of the drive's default keys. z/VM 5.3 is needed if you want to specify the key on ATTACH. There are no dependencies or interaction with RACF or any other ESM on z/VM. If you run the EKM on z/OS, then there are lots of z/OS RACF (or equivalent) things to be done if you choose to use ICSF as the EKM keystore and/or are using RACF on z/OS to generate the X.509 certficates. Alan Altmark z/VM Development IBM Endicott
