Program Directory for Cryptographic Support for z/os V1R13 - z/os V2R2. Program Number 5650-ZOS FMID HCR77B1. for Use with z/os V1R13 - z/os V2R2

Transcription

1 IBM Program Directory for Cryptographic Support for z/os V1R13 - z/os V2R2 Program Number 5650-ZOS FMID HCR77B1 for Use with z/os V1R13 - z/os V2R2 Document Date: November, 2015 GI

2 Note Before using this information and the product it supports, be sure to read the general information under 7.0, Notices on page 29. A form for reader's comments appears at the back of this publication. When you send information to IBM, you grant IBM a nonexclusive right to use or distribute the information in any way it believes appropriate without incurring any obligation to you. Copyright International Business Machines Corporation 2005, All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

3 Contents 1.0 Introduction Cryptographic Support Description Cryptographic Support FMIDs Program Materials Basic Machine-Readable Material Optional Machine-Readable Material Program Publications Basic Program Publications Optional Program Publications Program Source Materials Publications Useful During Installation Program Support Program Services Preventive Service Planning Statement of Support Procedures Program and Service Level Information Program Level Information Service Level Information Understanding Cryptographic Support Service Installation Requirements and Considerations Driving System Requirements Machine Requirements Programming Requirements Target System Requirements Machine Requirements Programming Requirements Installation Requisites Operational Requisites Toleration/Coexistence Requisites Incompatibility (Negative) Requisites DASD Storage Requirements FMIDs Deleted Special Considerations Installation Instructions Installing Cryptographic Support SMP/E Considerations for Using the SMP/E Web Download SMP/E Options Subentry Values Copyright IBM Corp. 2005, 2015 iii

4 6.1.3 SMP/E CALLLIBS Processing Sample Jobs Allocate SMP/E Target and Distribution Libraries Allocate File system Paths Create DDDEF Entries Perform SMP/E APPLY Perform SMP/E ACCEPT Cleaning Up Obsolete Data Sets, Paths, and DDDEFs Activating Cryptographic Support File System Execution Notices Trademarks Reader's Comments Figures 1. Basic Material: Unlicensed Publications Publications Useful During Installation PSP Upgrade and Subset ID Component IDs Driving System Software Requirements Target System Mandatory Installation Requisites Target System Mandatory Operational Requisites Target System Conditional Operational Requisites Total DASD Space Required by Cryptographic Support Storage Requirements for Cryptographic Support Target Libraries Cryptographic Support FILE SYSTEM Paths Storage Requirements for Cryptographic Support Distribution Libraries SMP/E Options Subentry Values Sample Installation Jobs SMP/E APPLY SMP/E ACCEPT sample iv Cryptographic Support Program Directory

5 1.0 Introduction This program directory is intended for the system programmers who are responsible for program installation and maintenance. It contains information about the material and procedures associated with the installation of Cryptographic Support for z/os V1R13 - z/os V2R2. This publication refers to Cryptographic Support for z/os V1R13 - z/os V2R2 as Cryptographic Support. Cryptographic Support for z/os V1R13 - z/os V2R2 is a Web deliverable and a complete FMID replacement. The Program Directory contains the following sections: 2.0, Program Materials on page 3 identifies the basic and optional program materials and documentation for Cryptographic Support. 3.0, Program Support on page 5 describes the IBM support available for Cryptographic Support. 4.0, Program and Service Level Information on page 9 lists the APARs (program level) and PTFs (service level) that have been incorporated into Cryptographic Support. 5.0, Installation Requirements and Considerations on page 11 identifies the resources and considerations that are required for installing and using Cryptographic Support. 6.0, Installation Instructions on page 21 provides detailed installation instructions for Cryptographic Support. It also describes the procedures for activating the functions of Cryptographic Support, or refers to appropriate publications. Before installing Cryptographic Support, read 3.2, Preventive Service Planning on page 5. This section tells you how to find any updates to the information and procedures in this program directory. 1.1 Cryptographic Support Description Cryptographic Support contains one subelement from Cryptographic Services (ICSF) of z/os that works with hardware cryptographic features and the Security Server (RACF ) feature to provide secure, high-speed cryptographic services. Cryptographic Support provides the programming interfaces by which applications request the cryptographic functions. The cryptographic features available to your applications depends on the server or processor hardware. You can download the Cryptographic Support Web deliverable from Copyright IBM Corp. 2005,

6 1.2 Cryptographic Support FMIDs Cryptographic Support consists of the following FMIDs: HCR77B1 (ICSF) The Cryptographic Support Web deliverable has been fully system tested with z/os V1R13 - z/os V2R2. End of service for a Web deliverable occurs at end of service for the release on which it runs. 2 Cryptographic Support Program Directory

7 2.0 Program Materials An IBM program is identified by a program number. The program number for Cryptographic Support is 5650-ZOS. There is no feature number for Cryptographic Support as it is being delivered through the Web download site. Basic Machine-Readable Materials are materials that are supplied under the base license and feature numbers, and are required for the use of the product. The program announcement material describes the features supported by Cryptographic Support. Ask your IBM representative for this information if you have not already received a copy. 2.1 Basic Machine-Readable Material The distribution medium for this program is Web Delivery. The code for this deliverable can be downloaded from URL - The deliverable contains all the programs and data needed for installation. This program is in SMP/E RELFILE format and is installed by using SMP/E. See 6.0, Installation Instructions on page 21 for more information about how to install the program. 2.2 Optional Machine-Readable Material No optional machine-readable materials are provided for Cryptographic Support. 2.3 Program Publications The following sections identify the basic and optional publications for Cryptographic Support Basic Program Publications Figure 1 identifies the basic unlicensed program publications for Cryptographic Support. The publications can be obtained from: IBM Resource Link at (Click on "publications" and then on "HCR77B1" under "ICSF Publications by FMID".) IBM z/os downloads for Cryptographic Support for z/os V1R13 - z/os V2R2 at Regardless of the method you use to obtain the ducumentation, make sure you have the correct level of the book (as shown in the final two digits of the form number in the following table). Copyright IBM Corp. 2005,

8 Figure 1. Basic Material: Unlicensed Publications Publication Title ICSF Overview ICSF System Programmer's Guide ICSF Administrator's Guide ICSF Application Programmer's Guide ICSF Messages ICSF Writing PKCS #11 Applications Form Number SC SC SC SC SC SC Optional Program Publications No optional publications are provided for Cryptographic Support. 2.4 Program Source Materials No program source materials or viewable program listings are provided for Cryptographic Support. 2.5 Publications Useful During Installation You might want to use the publications listed in Figure 2 during the installation of Cryptographic Support. To order copies, contact your IBM representative or visit the IBM Publications Center at Figure 2. Publications Useful During Installation Publication Title IBM SMP/E for z/os User's Guide IBM SMP/E for z/os Commands IBM SMP/E for z/os Reference IBM SMP/E for z/os Messages, Codes, and Diagnosis Form Number SA SA SA GA Cryptographic Support Program Directory

9 3.0 Program Support This section describes the IBM support available for Cryptographic Support. 3.1 Program Services Contact your IBM representative for specific information about available program services. 3.2 Preventive Service Planning Before you install Cryptographic Support, make sure that you have reviewed the current Preventive Service Planning (PSP) information. The PSP Buckets maintain current lists (which have been identified since the package was created) of any recommended or required service for the installation of this package. This service includes software PSP information (ZOSV1R13/ZOSV2R1/ZOSV2R2 PSP Bucket, subset ICSF77B1) that contains HIPER, and/or required PTFs against the base release. Although SW, HW, and functional PSP Buckets might have overlap, review all that apply to this package to ensure that you identify all the known service that is required for your installation of this package. For program support, access the Software Support Web site at PSP Buckets are identified by UPGRADEs, which specify product levels; and SUBSETs, which specify the FMIDs for a product level. The UPGRADE and SUBSET values for Cryptographic Support are shown as follows: Figure 3. PSP Upgrade and Subset ID UPGRADE SUBSET Description ZOSV1R13 ICSF77B1 Cryptographic Services ICSF ZOSV2R1 ICSF77B1 Cryptographic Services ICSF ZOSV2R2 ICSF77B1 Cryptographic Services ICSF Notes: 1. For additional requirements for the z990 server, refer to the hardware PSP Bucket 2084DEVICE, subset 2084/ZOS. For additional requirements for the z890 server, refer to the hardware PSP Bucket 2086DEVICE, subset 2086/ZOS. 2. For additional requirements for the IBM System z9 Enterprise Class (z9 EC), refer to the hardware PSP Bucket 2094DEVICE, subset 2094/ZOS. For additional requirements for the IBM System z9 Business Class (z9 BC), refer to the hardware PSP Bucket 2096DEVICE, subset 2096/ZOS. Copyright IBM Corp. 2005,

10 3. For additional requirements for the IBM System z10 Enterprise Class (z10 EC), refer to the hardware PSP Bucket 2097DEVICE, subset 2097/ZOS. For additional requirements for the IBM System z10 Business Class (z10 BC), refer to the hardware PSP Bucket 2098DEVICE, subset 2098/ZOS. 4. For additional requirements for the IBM zenterprise 196 (z196), refer to the hardware PSP Bucket 2817DEVICE, subset 2817/ZOS. For additional requirements for the IBM zenterprise 114 (z114), refer to the hardware PSP Bucket 2818DEVICE, subset 2818/ZOS. 5. For additional requirements the IBM Enterprise System (zenterprise) EC12 (zec12), refer to the hardware PSP Bucket 2827DEVICE, subset 2827/ZOS. For additional requirements for the IBM Enterprise System (zenterprise) BC12 (zbc12), refer to the hardware PSP Bucket 2828DEVICE, subset 2828/ZOS. 6. For additional requirements the IBM z13, refer to the hardware PSP Bucket 2964DEVICE, subset 2964/ZOS. To assist you in determining whether you have the recommended service installed on your system, which is identified in these PSP buckets, you can use the SMP/E REPORT MISSINGFIX command in conjunction with the FIXCAT type of HOLDDATA, as follows: 1. Acquire and RECEIVE the latest HOLDDATA onto your z/os system(s). Use your normal service acquisition portals or download the two (2) year HOLDDATA directly from Ensure you use the FULL file (last 730 days) to receive the FIXCAT HOLDDATA, as the other files do not contain FIXCAT HOLDDATA. 2. Run the SMP/E REPORT MISSINGFIX command on your z/os systems and specify one or more of the following Fix Categories (wildcarding can be used): IBM.Device.Server.z for a z990 server IBM.Device.Server.z for a z890 server IBM.Device.Server.z9-EC for an IBM System z9 Enterprise Class (z9 EC) server IBM.Device.Server.z9-BC for an IBM System z9 Business Class (z9 BC) server IBM.Device.Server.z10-EC for an IBM System z10 Enterprise Class (z10 EC) server IBM.Device.Server.z10-BC for an IBM System z10 Business Class (z10 BC) server IBM.Device.Server.z for an IBM zenterprise 196 (z196) central processing complex (CPC) IBM.Device.Server.z for an IBM zenterprise 114 (z114) central processing complex (CPC) IBM.Device.Server.zEC for an IBM Enterprise System (zenterprise) EC12 (zec12) central processing complex (CPC) IBM.Device.Server.zBC for an IBM Enterprise System (zenterprise) BC12 (zbc12) central processing complex (CPC) IBM.Device.Server.z for an IBM z13 central processing complex (CPC) 6 Cryptographic Support Program Directory

11 The report will identify any missing coexistence and fallback PTFs for that system. For complete information about the REPORT MISSINGFIX command, see SMP/E Commands. 3. Periodically, you might want to acquire the latest HOLDDATA and rerun the REPORT MISSINGFIX command to find out if there are any new PTFs recommended for the server. 3.3 Statement of Support Procedures Report any problems that you feel might be an error in the product materials to your IBM Support Center. You might be asked to gather and submit additional diagnostics to assist the IBM Support Center in their analysis. Figure 4 identifies the component IDs (COMPID) for Cryptographic Support. Figure 4. Component IDs FMID COMPID Component Name HCR77B ICSF 7B1 RETAIN Release Program Support 7

12 8 Cryptographic Support Program Directory

13 4.0 Program and Service Level Information This section identifies the program and relevant service levels of Cryptographic Support. The program level refers to the APAR fixes that have been incorporated into the program. The service level refers to the PTFs that have been incorporated into the program. 4.1 Program Level Information The following APAR fixes against previous releases of Cryptographic Support have been incorporated into this release. They are listed by FMID. FMID HCR77B1 OA46845 OA46990 OA47157 OA46373 OA47383 OA47845 OA47754 OA47410 OA46466 OA48159 OA47420 OA47016 OA48522 OA47781 OA48200 OA48189 OA48788 OA48873 OA Service Level Information No PTFs against this release of Cryptographic Support have been incorporated into the Web deliverable. After the Web deliverable is created, additional PTFs can be created against it. For that matter, you must review relevant (HW and) SW PSP information to ensure that your system does not hit any known problems when you install and activate this package. If a functional PSP Bucket is created, it can also be used to identify a complete set of service that is required or recommended for this package. It is highly recommended that you frequently check the Cryptographic Support PSP Bucket (ZOSV1R13/ZOSV2R1/ZOSV2R2, subset ICSF77B1) for HIPER and SPECIAL Attention PTFs against all FMIDs that you must install. 4.3 Understanding Cryptographic Support Service You did not receive any service with your deliverable. Copyright IBM Corp. 2005,

14 10 Cryptographic Support Program Directory

15 5.0 Installation Requirements and Considerations The following sections identify the system requirements for installing and activating Cryptographic Support. The following terminology is used: Driving system: the system used to install the program; where SMP/E executes. The program might have specific operating system or product level requirements for using processes, such as binder or assembly utilities during the installation. Target system: the system on which the program is configured and run. The program might have specific product level requirements, such as needing access to the library of another product for link-edits. These requirements, either mandatory or optional, might directly affect the element during the installation or in its basic or enhanced operation. In many cases, you can use a system as both a driving system and a target system. However, you can make a separate IPL-able clone of the running system to use as a target system. The clone must include copies of all system libraries that SMP/E updates, copies of the SMP/E CSI data sets that describe the system libraries, and your PARMLIB and PROCLIB. Use separate driving and target systems in the following situations: When you install a new level of a product that is already installed, the new level of the product will replace the old one. By installing the new level onto a separate target system, you can test the new level and keep the old one in production at the same time. When you install a product that shares libraries or load modules with other products, the installation can disrupt the other products. By installing the product onto a separate target system, you can access these impacts without disrupting your production system. 5.1 Driving System Requirements This section describes the environment of the driving system that is required to install Cryptographic Support Machine Requirements The driving system can run in any hardware environment that supports the required software Programming Requirements Copyright IBM Corp. 2005,

16 Figure 5. Driving System Software Requirements Program Number Product Name Minimum VRM Minimum Service Level will satisfy these APARs 5694-A01 z/os V or later N/A No 5650-ZOS z/os V2.1.0 or later N/A No Included in the shipped product? Note: Installation might require migration to new z/os releases to be service supported. See Target System Requirements This section describes the environment of the target system that is required to install and use Cryptographic Support. Cryptographic Support installs in the z/os (Z038) SREL Machine Requirements The target system can run in any hardware environment that supports the required software. The IBM eserver zseries z990 Server and IBM eserver zseries z890 Server require feature 3863, CP Assist for Cryptographic Functions (CPACF) DES/TDES, to be installed to use Cryptographic Support. The z990 and z890 servers also support optional feature 0863, the PCI X Cryptographic Coprocessor (PCIXCC) and Crypto Express2 Coprocessor (CEX2C). The IBM PCI Cryptographic Accelerator (PCICA) is another optional feature (feature code 0862). HCR77B1 can run on the IBM eserver zseries z990 Server and IBM eserver zseries z890 Server. The IBM z9 and z10 Servers require feature 3863, CP Assist for Cryptographic Functions (CPACF) DES/TDES, to be installed to use Cryptographic Support. The z9 server also supports optional feature 0863, the Crypto Express2 feature. The z10 server also supports optional feature 0863, the Crypto Express2 feature, and optional feature 0864, the Crypto Express3 feature. HCR77B1 can run on the IBM z9 and z10 Servers. The IBM z196 and z114 server requires feature 3863, CP Assist for Cryptographic Functions (CPACF) DES/TDES, to be installed to use Cryptographic Support. The z196 and z114 server also supports optional feature 0864, the Crypto Express3 feature. HCR77B1 can run on the IBM z196 Server and IBM z114 Server. 12 Cryptographic Support Program Directory

17 The zenterprise zec12 and zbc12 server requires feature 3863, CP Assist for Cryptographic Functions (CPACF) DES/TDES, to be installed to use Cryptographic Support. The zenterprise zec12 and zbc12 server also supports optional feature 0864, the Crypto Express3 feature and 0865, the Crypto Express4 feature. HCR77B1 can run on the IBM zec12 Server and IBM zbc12 Server. The z13 server requires feature 3863, CP Assist for Cryptographic Functions (CPACF) DES/TDES, to be installed to use Cryptographic Support. The z13 server also supports optional feature 0890, the Crypto Express5 feature. HCR77B1 can run on the IBM z13 Server Programming Requirements Installation Requisites: Installation requisites identify products that are required by and must be present on the system or products that are not required by but should be present on the system for the successful installation of this product. Mandatory installation requisites identify products that are required on the system for the successful installation of this product. These products are specified as PREs or REQs. Figure 6. Target System Mandatory Installation Requisites Program Number Product Name Minimum VRM Minimum Service Level will satisfy these APARs 5694-A01 z/os V N/A No 5650-ZOS z/os V2.1.0 or later N/A No Included in the shipped product? Note: Installation might require migration to new z/os releases to be service supported. See To download the Cryptographic Support Web deliverable, see Conditional installation requisites identify products that are not required for successful installation of this product but can resolve such things as certain warning messages at installation time. These products are specified as IF REQs. Cryptographic Support has no conditional installation requisites. Installation Requirements and Considerations 13

18 Operational Requisites: Operational requisites are products that are required by and must be present on the system or products that are not required by but should be present on the system for this product to operate all or part of its functions. Mandatory operational requisites identify products that are required for this product to operate its basic functions. These products are specified as PREs or REQs. Figure 7. Target System Mandatory Operational Requisites Program Number Any one of the following: Product Name and Minimum VRM/Service Level 5694-A01 Language Environment for z/os V ZOS Language Environment for z/os V2.1.0 or later Conditional operational requisites identify products that are not required for this product to operate its basic functions but are required at run time for this product to operate its specific functions. These products are specified as IF REQs. Here are the conditional operational requisites for ICSF: Figure 8. Target System Conditional Operational Requisites Program Number Any one of the following: Product Name and Minimum VRM/Service Level 5694-A01 z/os V with PTF for Consoles APAR OA ZOS z/os V2.1.0 or later Function Support for ICSF Console commands Toleration/Coexistence Requisites: Toleration/coexistence requisites identify products that must be present on a sharing systems. These systems can be other systems in a multisystem environment (not necessarily sysplex), a shared DASD environment (such as test and production), or systems that reuse the same DASD environment at different time intervals. Here are the toleration requisites for ICSF in a sysplex environment: For systems with ICSF FMID HCR7780 or earlier, PTFs for APAR 0A36718, OA39484, OA39075, OA42014 and OA45547 must be installed. For systems with ICSF FMID HCR7790 or earlier, PTFs for APAR OA39484, OA39075, OA42014 and OA45547 must be installed. For systems with ICSF FMID HCR77A0 or earlier, PTFs for APAR OA42014, OA45547 and OA48403 must be installed. 14 Cryptographic Support Program Directory

19 For systems with ICSF FMID HCR77A1 or earlier, PTFs for APAR OA42014, OA45547 and OA48403 must be installed. For systems with ICSF FMID HCR77B0 or earlier, PTFs for APAR OA48403 must be installed. Before introducing ICSF FMID HCR77B1 into your environment, install coexistence and fallback PTFs on all pre-hcr77b1 systems with which your HCR77B1 system will coexist. Use the SMP/E REPORT MISSINGFIX command in conjunction with the FIXCAT type of HOLDDATA as follows: 1. Acquire and RECEIVE the latest HOLDDATA onto your pre-hcr77b1 systems. Use your normal service acquisition portals or download the HOLDDATA directly from Ensure that you select Full from the Download NOW column to receive the FIXCAT HOLDDATA, as the other files do not contain FIXCATs. 2. Run the SMP/E REPORT MISSINGFIX command on your pre-hcr77b1 systems and specify a Fix Category (FIXCAT) value of "IBM.Coexistence.ICSF.z/OS_V1R13-V2R2-HCR77B1". The report will identify any missing coexistence and fallback PTFs for that system. For complete information about the REPORT MISSINGFIX command, see SMP/E Commands. 3. Periodically, you might want to acquire the latest HOLDDATA and rerun the REPORT MISSINGFIX command to find out if there are any new coexistence and fallback PTFs Incompatibility (Negative) Requisites: Negative requisites identify products that must not be installed on the same system as this product. Cryptographic Support has no negative requisites DASD Storage Requirements Cryptographic Support libraries can reside on all supported DASD types. Figure 9 lists the total space that is required for each type of library. Figure 9. Total DASD Space Required by Cryptographic Support Library Type Target 415 Distribution 429 File System Total Space Required in 3390 Trks 26 Notes: Installation Requirements and Considerations 15

20 1. For non-recfm U data sets, IBM recommends using system-determined block sizes for efficient DASD utilization. For RECFM U data sets, IBM recommends using a block size of 32760, which is most efficient from the performance and DASD utilization perspective. 2. Abbreviations used for the data set types are shown as follows. U S E Unique data set, allocated by this product and used by only this product. This table provides all the required information to determine the correct storage for this data set. You do not need to refer to other tables or program directories for the data set size. Shared data set, allocated by this product and used by this product and other products. To determine the correct storage needed for this data set, add the storage size given in this table to those given in other tables (perhaps in other program directories). If the data sets already exists, it must have enough free space to accommodate the storage size given in this table. Existing shared data set, used by this product and other products. This data set is not allocated by this product. To determine the correct storage needed for this data set, add the storage size given in this table to those given in other tables (perhaps in other program directories). If the data set already exists, it must have enough free space to accommodate the storage size given in this table. If you currently have a previous release of this product installed in these libraries, the installation of this release will delete the old release and reclaim the space that was used by the old release and any service that had been installed. You can determine whether or not these libraries have enough space by deleting the old release with a dummy function, compressing the libraries, and comparing the space requirements with the free space in the libraries. For more information about the names and sizes of the required data sets, see 6.1.5, Allocate SMP/E Target and Distribution Libraries on page Abbreviations used for the file system path type are as follows. N X P New path, created by this product. Path created by this product, but may already exist from a previous release. Previously existing path, created by another product. 4. All target and distribution libraries listed have the following attributes: The default name of the data set may be changed. The default block size of the data set may be changed. The data set may be merged with another data set that has equivalent characteristics. The data set may be either a PDS or a PDSE. 5. All target libraries listed have the following attributes: These data sets can be SMS-managed, but they are not required to be SMS-managed. These data sets are not required to reside on the IPL volume.me. The values in the "Member Type" column are not necessarily the actual SMP/E element types that are identified in the SMPMCS. 6. All target libraries that are listed and contain load modules have the following attributes: These data sets can be in the LPA, but they are not required to be in the LPA. If ICSF modules are to be manually added to LPA they must be in Fixed LPA and not Modifiable LPA (MLPA). 16 Cryptographic Support Program Directory

21 These data sets can be in the LNKLST. It is required for SCSFMOD0 to be APF-authorized. No other libraries require APF authorization. The following figures describe the target and distribution libraries required to install Cryptographic Support. The storage requirements of Cryptographic Support must be added to the storage required by other programs having data in the same library or path. Note: The data in these tables should be used when determining which libraries can be merged into common data sets. In addition, since some ALIAS names may not be unique, ensure that no naming conflicts will be introduced before merging libraries. Figure 10. Storage Requirements for Cryptographic Support Target Libraries Library DDNAME Member Type Target Volume T Y P E O R G R E C F M L R E C L No. of 3390 Trks CCSSLIB Lmod TVOL2 E PDS U MACLIB Macro TVOL2 E PDS FB MIGLIB Module TVOL1 E PDS U MODGEN Macro TVOL2 E PDS FB PARMLIB Parm TVOL1 E PDS FB SAMPLIB Sample TVOL2 E PDS FB SCSFCLI0 Clist TVOL1 U PDS FB SCSFHDRS Data TVOL2 U PDS FB SCSFMOD0 Lmod TVOL1 U PDS U SCSFMOD1 Lmod TVOL1 U PDS U SCSFMSG0 Message TVOL1 U PDS FB SCSFOBJ Data TVOL2 U PDS FB SCSFPNL0 Panel TVOL1 U PDS FB SCSFSKL0 Skeleton TVOL1 U PDS FB SCSFTLIB Table TVOL1 U PDS FB SIEAHDR Data TVOL1 E PDS VB SIEASID Data TVOL1 E PDS FB SIEALNKE Program TVOL1 E PDS-E U N/A No. of DIR Blks Installation Requirements and Considerations 17

22 Figure 11. Cryptographic Support FILE SYSTEM Paths DDNAME T Y P E Path Name SCSFHFS X /usr/lpp/pkcs11/ibm/ Figure 12. Storage Requirements for Cryptographic Support Distribution Libraries Library DDNAME T Y P E O R G R E C F M L R E C L No. of 3390 Trks AMACLIB E PDS FB AMIGLIB E PDS U AMODGEN E PDS FB APARMLIB E PDS FB ASAMPLIB E PDS FB ACSFCLI0 U PDS FB ACSFHDRS U PDS FB ACSFHFS U PDS VB ACSFMOD0 U PDS U ACSFMOD1 U PDS U ACSFMSG0 U PDS FB ACSFOBJ U PDS FB ACSFPNL0 U PDS FB ACSFSKL0 U PDS FB ACSFTLIB U PDS FB AIEAHDR E PDS VB AIEASID E PDS FB AIEALNKE E PDS-E U N/A No. of DIR Blks 18 Cryptographic Support Program Directory

23 5.3 FMIDs Deleted Installing Cryptographic Support might result in the deletion of other FMIDs. To see which FMIDs will be deleted, examine the ++VER statement in the SMPMCS of the product. If you do not want to delete these FMIDs at this time, install Cryptographic Support into separate SMP/E target and distribution zones. Note: These FMIDs are not automatically deleted from the Global Zone. If you want to delete these FMIDs from the Global Zone, see the SMP/E manuals for instructions. 5.4 Special Considerations Cryptographic Support has no special considerations for the target system. Installation Requirements and Considerations 19

24 20 Cryptographic Support Program Directory

25 6.0 Installation Instructions This chapter describes the installation method and the step-by-step procedures to install and to activate the functions of Cryptographic Support. Please note the following: If you want to install Cryptographic Support into its own SMP/E environment, consult the SMP/E manuals for instructions on creating and initializing the SMPCSI and the SMP/E control data sets. You can use the sample jobs that are provided to perform part or all of the installation tasks. The SMP/E jobs assume that all DDDEF entries that are required for SMP/E execution have been defined in appropriate zones. You can use the SMP/E dialogs instead of the sample jobs to accomplish the SMP/E installation steps. 6.1 Installing Cryptographic Support This product is available as a Web download package. If you are downloading this product from the Web, follow the instructions below SMP/E Considerations for Using the SMP/E Web Download The SMP/E Web download package for Cryptographic Support is packaged using the SMP/E GIMZIP function, which was introduced in SMP/E for z/os V3.1. Although GIMZIP and GIMUNZIP are used for the packaging, the full SMP/E RECEIVE FROMNETWORK function is not available with this package. The SMP/E GIMUNZIP function is required to process the downloaded package. See the z/os SMP/E Reference for information about using GIMZIP and GIMUNZIP. Ensure that you meet the driving system requirements as documented in Driving System Requirements. Perform the following tasks: 1. Ensure that the configuration requirements for using GIMUNZIP are completed. For a description of the GIMZIP and GIMUNZIP functions, see the SMP/E web page at 2. Allocate a R/W file system directory on the z/os system where the package will be staged. The R/W file system directory is the repository for the download package. 3. Download the Web package from the following Web site: The package contains two parts: a. CRYPTO15.README.txt This file contains a sample job that performs the following tasks. You must update this file to reflect your environment. Make sure this file is transferred from the download site as a text file. Copyright IBM Corp. 2005,

26 Executes the z/os UNIX System Services pax command to extract the GIMZIP archives from the download package. Executes the GIMUNZIP program to expand the GIMZIP archives and places their contents in data sets that can be processed by SMP/E. Executes the SMP/E RECEIVE from DASD function to receive the FMID. b. CRYPTO15.pax.Z This pax archive file contains the SMP/E MCS and the associated RELFILEs. You must download this pax archive file to a node that has connectivity to be downloaded to a node that has connectivity to the target z/os system. Transfer the file to the host using binary format. 4. Run the sample job in CRYPTO.README.txt. This job will perform the required tasks up to and including the SMP/E RECEIVE from DASD step. Expected return codes: RC=0 5. You must upgrade your target system (z/os V or later) with current service. To obtain PTF service for the Cryptographic Support FMID, refer to 3.2, Preventive Service Planning on page Complete the installation by using the instructions in this program directory SMP/E Options Subentry Values The recommended values for certain SMP/E CSI subentries are shown in Figure 13. Using values lower than the recommended values can result in failures in the installation. DSSPACE is a subentry in the GLOBAL options entry. PEMAX is a subentry of the GENERAL entry in the GLOBAL options entry. See the SMP/E manuals for instructions on updating the global zone. Figure 13. SMP/E Options Subentry Values Subentry Value Comment DSSPACE Existing target CSI value IBM suggests using your existing target system CSI's DSSPACE value. PEMAX SMP/E Default IBM suggests using the SMP/E default for PEMAX SMP/E CALLLIBS Processing Cryptographic Support uses the CALLLIBS function that is provided in SMP/E to resolve external references during installation. When Cryptographic Support is installed, ensure that DDDEFs exist for the following libraries: CSSLIB SCEELKED SCEESPC SCSFMOD1 SDFHLOAD 22 Cryptographic Support Program Directory

27 Note: CALLLIBs uses the previous DDDEFs only to resolve the link-edit for Cryptographic Support. These data sets are not updated during the installation of Cryptographic Support, except for SCSFMOD1, which is an ICSF data set and is included in the Cryptographic Support package, CSSLIB, which is used as both a CALLLIB to resolve the link-edit for for Cryptographic Support and as a target dataset to which the Cryptographic Support APIs are added. Please see "Allocate SMP/E Target and Distribution Libraries" on page 23 and "Create DDDEF Entries" on page 24 for more details about the CCSSLIB definition Sample Jobs The following sample installation jobs are provided as part of the product to help you install Cryptographic Support: Figure 14. Sample Installation Jobs Job Name Job Type Description RELFILE CSFALLOC ALLOCATE Sample job to allocate target and distribution libraries for ICSF 'prefix.hcr77b1.f1' CSFDDDEF DDDEF Sample job to define SMP/E DDDEFs for ICSF 'prefix.hcr77b1.f1' CSFISMKD MKDIR Sample job to invoke the supplied CSFMKDIR EXEC to allocate file system paths 'prefix.hcr77b1.f1' You can access the sample installation jobs by performing an SMP/E RECEIVE and then copying the jobs from the relfiles to a work data set for editing and submission. See Figure 14 to find the appropriate relfile data set Allocate SMP/E Target and Distribution Libraries Edit and submit sample job CSFALLOC to allocate the SMP/E target and distribution libraries for Cryptographic Support. If installing into separate target zone, and not using an existing shared data set for CSSLIB, edit and submit sample job CSFALLOC to allocate new target data set CSSLIB. If using an existing shared data set for CSSLIB and in the same target zone with z/os, there is no need to edit and submit sample job CSFALLOC. However, you must determine whether the existing shared data set for CSSLIB has enough free space to accommodate the additional storage size given in figure 10 in Section Consult the instructions in the sample job for more information. Expected Return Codes and Messages: RC=0 Installation Instructions 23

28 6.1.6 Allocate File system Paths Mount the file system data set of the target system on the driving system when you run the sample CSFISMKD job because the job will create paths in the file system. Before you run the sample job to create the paths in the file system, you must ensure that OMVS is active on the driving system, and that the file system of the target system is mounted to the driving system. If you install Cryptographic Support into a zfs file system, zfs must be active on the driving system. If you plan to install Cryptographic Support into a new file system, you must create the mountpoint and mount the new file system to the driving system. For Cryptographic Support, the recommended mountpoint is: /usr/lpp/pkcs11. The CSFISMKD job invokes CSFMKDIR exec to create the pkcs11 directories under -PathPrefix-, which is the high level directory name. Before running the sample job, you must ensure the directory path -PathPrefix- exists. Edit and submit sample job CSFISMKD to allocate the file system paths for Cryptographic Support. Consult the instructions in the sample job for more information. Expected Return Codes and Messages: RC= Create DDDEF Entries Edit and submit sample job CSFDDDEF to create DDDEF entries for the SMP/E target and distribution libraries for Cryptographic Support. If you install ICSF into the same target libraries as z/os, then the new CCSSLIB DDDEF entry should identify the z/os CSSLIB target data set, SYS1.CSSLIB. If you install ICSF into target libraries separate from z/os, then all ICSF target libraries, including the new CCSSLIB DDDEF entry, should identify unique data sets. Consult the instructions in the sample job for more information. Expected Return Codes and Messages: RC= Perform SMP/E APPLY 1. Ensure that you have the latest HOLDDATA; then edit and submit sample job, as shown in Figure 15 on page 26, to perform an SMP/E APPLY CHECK for Cryptographic Support. HOLDDATA introduces ERROR HOLDs against FMIDs for HIPER APARs. Before the installation, ensure that you have the latest Enhanced HOLDDATA, which is available through several different portals, including Install the FMIDs regardless of the status of unresolved HIPERs. However, don't deploy the software until the unresolved HIPERs are analyzed to determine applicability. 24 Cryptographic Support Program Directory

29 To receive the full benefit of the SMP/E Causer SYSMOD Summary Report, do not bypass the PRE, ID, REQ, and IFREQ on the APPLY CHECK. This is because the SMP/E root cause analysis identifies the cause of only errors but not warnings (SMP/E treats bypassed PRE, ID, REQ, and IFREQ conditions as warnings rather than errors). Here are two methods to install FMIDs when ++HOLDs for HIPERs exist for the FMIDs that you install: a. To ensure that all recommended and critical service is installed with the FMIDs, if you are using SMP/E 3.5 or higher and have received the latest HOLDDATA, add the FIXCAT operand to the APPLY command as shown below. If you are using a prior release of SMP/E, add the SOURCEID(HIPER,RSU*) operand to the APPLY command. If using SMP/E V3.5 or higher: APPLY S(HCR77B1) FORFMID(HCR77B1) SOURCEID(RSU*) FIXCAT(IBM.ProductInstall-RequiredService) GROUPEXTEND. If using SMP/E V3.4 or prior: APPLY S(HCR77B1) FORFMID(HCR77B1) SOURCEID(PRP,HIPER,RSU*,...) GROUPEXTEND. Some HIPER APARs might not have PTFs available yet. You have to analyze the symptom flags to determine if you want to bypass the specific ERROR HOLDs and continue the installation of the FMIDs. This method requires more initial research, but can provide resolution for all HIPERs that have fixes available and are not in a PE chain. Unresolved PEs or HIPERs might still exist and require the use of BYPASS. b. To install the FMIDs without regard for the HIPERs, you can add a BYPASS(HOLDCLASS(HIPER)) operand to the APPLY command. In this way, you can install FMIDs even though HIPER ERROR HOLDs against them still exist. Only the HIPER ERROR HOLDs are bypassed. After the FMIDs are installed, run the SMP/E REPORT ERRSYSMODS command to identify missing HIPER maintenance. APPLY S(HCR77B1) FORFMID(HCR77B1) SOURCEID(RSU*) GROUPEXTEND BYPASS(HOLDCLASS(HIPER)). other parameters documented in the program directory This method is the quicker of the two, but requires subsequent review of the REPORT ERRSYSMODS to investigate any HIPERs. If you are running SMP/E V3.5 or higher and have Installation Instructions 25

30 received the latest HOLDDATA, you can also choose to run REPORT MISSINGFIX for Fix Category IBM.ProductInstall-RequiredService to investigate missing recommended service. If you bypass any HOLDs during the installation of the FMIDs because fixing PTFs are not yet available, you can make yourself notified when the PTFs are available by using the APAR Status Tracking (AST) function of ServiceLink or the APAR Tracking function of ResourceLink. 2. After you have taken any actions that are indicated by the APPLY CHECK, remove the CHECK operand and run the job again to perform the APPLY. //APPLY JOB //STEP1 EXEC PGM=GIMSMP,REGION=0M,TIME=NOLIMIT //SMPCSI DD DSN=csiname,DISP=SHR //SMPCNTL DD * SET BOUNDARY(targetzone). APPLY CHECK FORFMID(HCR77B1) SELECT(HCR77B1) GROUPEXTEND(NOAPARS,NOUSERMODS) SOURCEID(ICSFFIX,HIPER) BYPASS(HOLDSYSTEM, HOLDUSER,HOLDCLASS(UCLREL,ERREL,HIPER)). /* Figure 15. SMP/E APPLY Required Updates 1. Update the job parameters. 2. Replace the csiname on the SMPCSI DD statement with your CSI name. 3. Update targetzone to your target zone name. 4. Update ICSFFIX with the name of the fixes that were required, as documented in the software PSP Bucket upgrades (ZOSV1R13/ZOSV2R1/ZOSV2R2) subset ICSF77B1. Note: The GROUPEXTEND operand indicates that SMP/E applies all requisite SYSMODs. The requisite SYSMODS might be applicable to other functions. Expected Return Codes and Messages from APPLY CHECK: RC=0 Expected Return Codes and Messages from APPLY: RC=0 Additional Link-Edit messages may appear if a null CICS library is defined. These will result in condition code 4 and are acceptable. For ICSF use of SMP/E CALLLIBS, warning messages are issued when the load modules are link-edited into the SMPLTS data set. For example, the following warning message is acceptable: IEW2454W SYMBOL xxxxxxxx UNRESOLVED. NO AUTOCALL(NCAL) SPECIFIED. 26 Cryptographic Support Program Directory

31 6.1.9 Perform SMP/E ACCEPT Edit and submit sample job, as shown in Figure 16 on page 27, to perform an SMP/E ACCEPT CHECK for Cryptographic Support. To receive the full benefit of the SMP/E Causer SYSMOD Summary Report, do not bypass the PRE, ID, REQ, and IFREQ on the ACCEPT CHECK. This is because the SMP/E root cause analysis identifies the cause of only errors but not warnings (SMP/E treats bypassed PRE, ID, REQ, and IFREQ conditions as warnings rather than errors). Before you use SMP/E to load new distribution libraries, it is recommended that you set the ACCJCLIN indicator in the distribution zone. In this way, you can save the entries that are produced from JCLIN in the distribution zone whenever a SYSMOD that contains inline JCLIN is accepted. For more information about the ACCJCLIN indicator, see the description of inline JCLIN in the SMP/E manuals. After you take actions that are indicated by the ACCEPT CHECK, remove the CHECK operand and run the job again to perform the ACCEPT. //ACCEPT JOB //STEP1 EXEC PGM=GIMSMP,REGION=0M,TIME=NOLIMIT //SMPCSI DD DSN=csiname,DISP=SHR //SMPCNTL DD * SET BOUNDARY(dlibzone). ACCEPT CHECK FORFMID(HCR77B1) SELECT(HCR77B1) GROUPEXTEND(NOAPARS,NOUSERMODS) SOURCEID(ICSFFIX,HIPER) BYPASS(HOLDSYSTEM, HOLDUSER,HOLDCLASS(UCLREL,ERREL,HIPER)). /* Figure 16. SMP/E ACCEPT sample Required Updates 1. Update the job parameters. 2. Replace the csiname on the SMPCSI DD statement with your CSI name. 3. Update dlibzone to your dlib zone name. 4. Update ICSFFIX with the name of the fixes that were required, as documented in the software PSP Bucket upgrades (ZOSV1R13/ZOSV2R1/ZOSV2R2) subset ICSF77B1. Installation Instructions 27

32 Note: The GROUPEXTEND operand indicates that SMP/E accepts all requisite SYSMODs. The requisite SYSMODS might be applicable to other functions. Expected Return Codes and Messages from ACCEPT CHECK: RC=0 If PTFs that contain replacement modules are accepted, SMP/E ACCEPT processing will link-edits or binds the modules into the distribution libraries. During this processing, the Linkage Editor or Binder might issue messages that indicate unresolved external references, which will result in a return code of 4 during the ACCEPT phase. You can ignore these messages, because the distribution libraries are not executable and the unresolved external references do not affect the executable system libraries. Expected Return Codes and Messages from ACCEPT: RC= Cleaning Up Obsolete Data Sets, Paths, and DDDEFs The following data sets, which were allocated and used by previous releases of this product, are no longer used in this release. You can delete these obsolete data sets after you delete the previous release from your system. hlq.acsfpubs hlq.acsfpshf hlq.scsfpubs hlq.scsfpshf The following DDDEF entries, which were created and used by previous releases of this product, are no longer used in this release. You can delete these obsolete DDDEF entries after you delete the previous release from your system. ACSFPUBS ACSFPSHF SCSFPUBS SCSFPSHF 6.2 Activating Cryptographic Support File System Execution If you mount the file system in which you have installed Cryptographic Support in read-only mode during execution, then you do not have to take further actions to activate Cryptographic Support. The z/os ICSF System Programmer's Guide contains the step-by-step procedures to activate the functions of Cryptographic Support. 28 Cryptographic Support Program Directory