Specifications

Chapter 13. Cryptographic adapter 133
13.3 Initial ICSF startup
For practical purposes, the ICSF software functions are needed to initialize cryptographic
adapters. Following is a brief outline of the steps we took to customize and use the ICSF
panels on a z/OS AD-CD 1.12 system. The use of the AD-CD system PARMLIB and
PROCLIB is not required, of course, and you should adjust these names for your needs.
Note that the CEX3C cyptographic adapters require ICSF at level HCR7770 or later. This
corresponds to the z/OS AD-CD release 1.12 or later. Earlier levels of z/OS may require the
fix for APAR OA29838 to be applied. This APAR causes the CEX3C devices to appear as
CES2C devices to the operating system and ICSF.
1. Create key storage data sets:
– Edit SYS1.SAMPLIB(CSFCKDS).
• Complete the JOB statement.
• Find the VOLUME(XXXXXX) parameter and change it to VOLUME (ZCSYS1).
3
• Submit the job for execution and check the results.
– Edit SYS1.SAMPLIB(CSFPKDS).
• Make the same changes and run the job.
– Edit SYS1.SAMPLIB(CSFTKDS). This data set is optional.
4
• Make the same changes and run the job.
2. Copy SYS1.SAMPLIB(CSFPRM00) to ADCD.Z112.PARMLIB(CSFPRM00).
– Edit this member to verify that it is as follows:
CKDSN(CSF.CSFCKDS)
PKDSN(CSF.CSFPKDS)
COMPAT(NO)
DOMAIN(0) <-- You may need to add this line
SSM(NO)
KEYAUTH(NO)
CHECKAUTH(NO)
TRACEENTRY(1000)
USERPARM(USERPARM)
REASONCODES(ICSF)
3. Copy SYS1.SAMPLIB(CSF) to ADCD.Z112.PROCLIB(CSF).
– Edit it as follows:
//CSF PROC
//CSF EXEC PGM=CSFMAIN,REGION=8M,TIME=1440
//CSFPARM DD DSN=ADCD.Z112.PARMLIB(CSFPRM00),DISP=SHR
4. Edit the ADCD PARMLIB member IKJTSO00 and add the following:
AUTHPGM NAMES( /* AUTHORIZED PROGRAM NAMES */ +
...
CSFDAUTH /*THIS WAS ALREADY IN OUR AD-CD SYSTEM */ +
CSFDPKDS /*WE ADDED THIS ONE */ +
AUTHTSF NAMES /*PROGRAMS...... */ +
3
ZBSYS1 is the volume of the AD-CD z/OS 1.11 system that contains system-related VSAM data sets. The use of
this particular volume is not required. If you plan to carry over your cryptographic configuration to future releases of
z/OS, then you should place these data sets on a local volume.
4
It is not used in our basic setup and operation instructions, but may be used for more advanced cryptographic
functions. These VSAM data sets are small; we included this one for completeness.