PKZIP /SecureZIP for zseries (OS/390 and z/os)

Transcription

1 PKZIP /SecureZIP for zseries (OS/390 and z/os) User s Guide SZZU-V8R2000 PKWARE Inc.

2 PKWARE Inc. 648 N Plankinton Avenue, Suite 220 Milwaukee, WI Sales: Sales - pksales@pkware.com Support: Support - Fax: Web Site: Edition (2005) SecureZIP for zseries, PKZIP for zseries, PKZIP for MVS, SecureZIP for iseries, PKZIP for iseries, PKZIP for OS/400, PKZIP for UNIX, SecureZIP for Windows, and PKZIP for Windows are just a few of the many members in the PKZIP family. PKWARE Inc. would like to thank all the individuals and companies -- including our customers, resellers, distributors, and technology partners -- who have helped make PKZIP the industry standard for Trusted ZIP solutions. PKZIP enables our customers to efficiently and securely transmit and store information across systems of all sizes, ranging from desktops to mainframes. This edition applies to the following PKWARE Inc. licensed programs: PKZIP for zseries (Version 8, Release 2, 2005) SecureZIP for zseries (Version 8, Release 2, 2005) SecureZIP for zseries Reader (Version 8, Release 2, 2005) SecureZIP for zseries SecureLink (Version 8, Release 2, 2005) PKZIP(R) is a registered trademark of PKWARE(R) Inc. SecureZIP is a trademark of PKWARE(R) Inc. Other product names mentioned in this manual may be a trademark or registered trademarks of their respective companies and are hereby acknowledged. Any reference to licensed programs or other material, belonging to any company, is not intended to state or imply that such programs or material are available or may be used. The copyright in this work is owned by PKWARE Inc., and the document is issued in confidence for the purpose only for which it is supplied. It must not be reproduced in whole or in part or used for tendering purposes except under an agreement or with the consent in writing of PKWARE Inc., and then only on condition that this notice is included in any such reproduction. No information as to the contents or subject matter of this document or any part thereof either directly or indirectly arising there from shall be given or communicated in any manner whatsoever to a third party being an individual firm or company or any employee thereof without the prior consent in writing of PKWARE Inc. Copyright PKWARE Inc. All rights reserved.

3 Contents PREFACE... 1 Notices...1 About this Manual...1 Conventions Used in This Manual...3 PKZIP and SecureZIP Manuals...3 Related Publications...4 Related Information on the Internet...5 User Help and Contact Information AN INTRODUCTION TO PKZIP AND SECUREZIP FOR ZSERIES... 6 Data Compression...7 ZIP Archives...7 Cyclic Redundancy Check...8 Distinctive Features of PKZIP and SecureZIP for zseries...8 Distinctive Features of SecureZIP for zseries...9 Encryption Using Passwords and/or Digital Certificates...10 Cross Platform Compatibility INTRODUCTION TO DATA SECURITY SecureZIP for zseries Security Basics...12 Operating System Levels...13 Digital Certificate Formats...13 SecureZIP for Windows Compatibility...13 General Information to Help You Get Started...14 How do we activate MASTER_RECIPIENT Contingency Keys?...14 Encryption...17 Authentication...17 iii

4 Data Integrity...18 Digital Signature Validation...18 Digital Signature Source Validation...19 Public-Key Infrastructure and Digital Certificates...19 Public-Key Infrastructure (PKI)...19 x Digital Certificates...20 Certificate Authority (CA)...20 Private Key...20 Public Key...21 Certificate Authority and Root Certificates...21 Setting Up Stores for Digital Certificates on zos...21 Setting Up the Certificate Stores...21 Updating the Certificate Stores...23 Types of Encryption Algorithms...23 FIPS 46-3, Data Encryption Standard (DES)...23 Triple DES Algorithm (3DES)...24 Advanced Encryption Standard (AES)...24 Comparison of the 3DES and AES Algorithms...24 RC Key Management...25 Passwords and PINS...26 Recipient Based Encryption...26 Random Number Generation...26 Integrity of Public and Private Keys PKZIP AND SECUREZIP FOR ZSERIES RELEASE INFORMATION Release Summary...28 New Products...28 New Features...28 New Commands and Defaults...31 Command Changes...34 Message Changes...36 Enhancements for Secure Data...36 Restrictions for PKZIP and SecureZIP for zseries...36 Region Size and Storage...38 SMS Dataclass Considerations...39 Note for users of PKZIP for MVS and PKZIP for zseries Reserved DDNAMEs...40 SYSPRINT...41 PKSPRINT...41 PKNODUMP...41 Use of System Utilities...41 SORT...41 Access Method Services...41 iv

5 IEBGENER...42 GRS/ENQ LICENSING Operating Requirements...43 Change of Release Licensing...43 Grace Period...43 Initializing the License GETTING STARTED WITH PKZIP AND SECUREZIP Introduction to PKZIP and SecureZIP for zseries...44 Invoking PKZIP/SECZIP or PKUNZIP/SECUNZIP Using JCL...45 Return Codes...46 Compressing a Dataset...46 Notes for Dataset Compression...47 Viewing the Contents of an Archive...47 Notes for Viewing the Contents of an Archive...48 ACTION(VIEWDETAIL)...48 Decompressing a Dataset...49 Notes for Decompressing a Dataset...49 Updating or Refreshing a File...50 Invoking the PKZIP and SecureZIP for zseries Utility...50 Invoking PKZIP/SecureZIP from JCL (Batch or Started Task)...50 Invoking PKZIP/SecureZIP as Called Programs Under TSO...51 Invoking ZIP or UNZIP TSO Command Line Interface...51 Valid ZIP Actions...52 Valid ZIP Options...53 Valid UNZIP Actions...53 Invoking the PKZIP and SecureZIP for zseries ISPF Panel Interface...55 Configuration Manager...55 Making Changes to the Defaults...56 Assembling Your Changes...56 Inputs...56 Configuration Manager Processing: Managing Control Statements...57 Control Statement Definitions...57 Troubleshooting...58 PKZIP and SecureZIP for zseries Messages...58 Debugging Controls ABOUT SECURITY, CERTIFICATES AND ENCRYPTION Terms and Acronyms Used in This Chapter...59 Accessing Certificates...60 v

6 Configuration Profile...60 Contents of the Configuration Profile...61 Data Base (DB) Profile (Local Certificate Store)...61 LDAP Profile (Networked Certificate Store)...61 Recipient Searches...62 Local Certificate Stores...63 Access x.509 Public and Private Key Certificates...63 Authentication and Certificate Validation Policies...64 Other Profile Commands...66 SecureZIP Certificate Store Administration and Configuration...67 Run-Time Configuration...68 Runtime Configuration Panel...68 Runtime Configuration Panel: Certificate Stores...68 SecureZIP Runtime Configuration Panel Undefined...70 SecureZIP Runtime Configuration Panel with DB Profile Defined...70 SecureZIP Runtime Configuration Panel with Private Certificate Location...71 Filename Encryption...71 How SecureZIP for zseries Encrypts File Names...71 When SecureZIP for zseries Encrypts File Names...72 Encrypting File Names When You Update an Archive...72 Opening and Viewing an Archive That Has Encrypted File Names...72 Input Required To View Recipients in a Filename Encrypted Archive...73 View of Recipients in a Filename Encrypted Archive...73 View Detail of an Archive that Has Encrypted File Names...74 Decrypting a Filename-Encrypted Archive...75 Security Examples...76 SecureZip using Recipients or Combo...76 Zip Compress File(s) to an Archive FIle (Option Z ) Using Recipients...77 SecureZIP Encryption Using Individual Recipients as Input...77 SecureZIP Certificate Report Option...79 SecureZIP Verification Window...79 SecureZIP Encryption Using Individual Recipients-Generated JCL...79 SecureZIP Encryption Using Recipient Job Output Listing with VERBOSE...80 SecureZIP Encryption Using Recipient Job Output Listing Without VERBOSE...81 SecureZIP Encryption Using a Recipients List...82 Editing the Recipients List...83 SecureZIP Encryption Using a Recipients List...83 SecureZIP Halt Process Request...84 SecureZIP Encryption Using LDAP Search for Recipients...84 SecureZIP Encryption Using LDAP Search for Recipients-Generated JCL...84 SecureZIP Encryption Using LDAP Search for Recipients - Output...85 Selecting Filename Encryption...86 Panel Option Z - Selecting Filename Encryption...86 Zip Compress File(s) to an Archive FIle (Option Z ) Using Passwords...87 SecureZIP Encryption...87 Cryptographic Algorithms...88 UNZip File(s) from an Archive (Option U ) Using Recipients...90 Unzip Panel (Option U ) Using Recipients...90 Unzip Output Using Recipients...91 View Display the Contents of an Archive File (Option V )...91 vi

7 View Detail Display...92 Incorrect Password Use FILE SELECTION AND NAME PROCESSING ZIP Processing File Selection...96 Primary File Selection Inputs...96 Cataloged Dataset Name Filter Requests...96 Exclusion Filters...97 INFILE DD Requests...97 JES2 SYSIN INFILE Support...97 Input ZIP Archive Files...98 File Selection Processing Notes...98 Cataloged Dataset Name and INFILE Request Restrictions...99 ZIP File Names Summary of Commands Affecting ZIP Filename Essentials for running PKZIP/SECZIP and PKUNZIP/SECUNZIP PKUNZIP/SECUNZIP ZIP FILES Data Formats - Text or Binary Data Format - Text Records Data Format - Binary Records File Attributes Data Set Name Transformation Large File Considerations Determining File Size FILE PROCESSING File Support Sequential Files Compressing Sequential Files Extracting Records into a Sequential File Managing a Sequential File ZIP Archive Processing GDGs File Concatenation for ZIP Processing PDS and PDSE Members Selecting PDS Members for Compression Extracting Data into a PDS Managing ZIP Archives as PDS Members Load Libraries vii

8 VSAM Files Compressing a VSAM File Extracting Data into a VSAM File Managing a VSAM ZIP Archive Magnetic Tapes and Cartridges Copying a Tape-Based Archive to a Disk File Compressing Data from Tape Extracting Data onto Tape Managing a ZIP Archive on Tape COMMANDS Command Syntax File Selections vs. Commands &SYSUID Summary of Available Commands Command Details Command Icon Legend ZIP ARCHIVES Old ZIP Archive Temporary Dataset New ZIP Archive PROCESSING WITH GZIP What Is GZIP? Why Use GZIP? PKZIP and SecureZIP for zseries Implementation Notes for GZIP GZIP Restrictions GZIP Extensions Processing GZIP Archives USING THE ISPF INTERFACE Getting Started with the ISPF Interface Configuration (Option C ) Defaults (Options ZD and UD) Primary Commands Changing Default Options Including Changed Defaults View Archive (Option V ) Setting VIEW Options Primary Commands Line Commands Display Fields viii

9 Using Security Archive Authenticated File Signers Zip (Option Z ) Using Security Select Password Protect Select Recipients Archive Signing File Signing Archive Authentication UNZIP (Option U ) Using Security Select Password Protect Select Recipients Archive Authentication File Authentication SYSPRINT Browse (Option S ) Messages (Option M ) License Display (Option L ) Certificate Stores (Option CS ) What s New (Option W ) Contact PKWARE (Option A ) USER API PROCESSING Overview Data Record Transformation API for ZIP processing File Name Manipulation API for UNZIP processing Invocation Negation of API processing Execution Environment File Name Manipulation API Data Record Transformation API User API Samples JCL and Sample Programs Assembler Assembler Source Assembler JCL Assembler Source DCTMAPIU DSECT COBOL COBOL JCL COBMAPIU copy member Sample input file - SAMPDAPI Output from sample jobs ASMFNAPI Sample Output XSMFNAPI Sample Output ix

10 User API_Module Program Exception Trap INVOKING PKZIP/PKUNZIP FROM AN APPLICATION PROGRAM CALLZIPA Sample Assembly Source to Call PKZIP CALLZIPC Sample COBOL Source to Call PKZIP CALLZIPP Sample PL/I Source to Call PKZIP CALLZIPR Sample REXX Source to Call PKZIP CALLZC Sample C source program to call PKZIP CALLZCPP Sample C++ program source to call PKZIP PKWARE PARTNERLINK: SECUREZIP READER/SECURELINK About SecureZIP for zseries Reader/SecureLink If You Are a Sponsor: Sign the Central Directory Terms and Acronyms Used in This Chapter PKWARE PartnerLink Program: Overview Decrypting and Extracting Sponsor Data (Reader Mode) Partner (SecureLink) Data Exchange to Sponsor Requirements License Operating Environment Sponsoring Configuration Functional Overview General Restrictions Reader (UNZIP) Processing Restrictions Archive Authentication Settings Decryption Certificate Selection File Signature Authentication Certificate Selection SecureLink (ZIP) Processing Restrictions Encryption Certificate Selection Archive Authentication Settings A (RESERVED) B SAMPLE JOBSTREAMS Example 1: Zip PDS to an Archive Example 2: Zip PDS to an Archive Example 3: Zip VSAM KSDS to an Archive Example 4: Summary View of a Dataset Example 5: Summary View of a Dataset x

11 Example 6: View with Detail of an Archive Example 7: Unzip an Archive to PDS Example 8: Unzip an Archive to PDS Example 9: Unzip an Archive to VSAM KSDS C 3490 INSTALLATION JCL (COPYCART) D MAKING CODE PAGE TRANSLATE TABLES (EDCICONV) Translation Tables Code Page Support International Code Page Support Code Conversion Utility Translate Table Generation Sample Job E FIPS-197 AES CERTIFICATION OF PKZIP AND SECUREZIP F CONTACT INFORMATION PROBLEM REPORTING General Licensing ISPF FTP SERVER requirements GLOSSARY INDEX xi

12 xii

13 Preface This manual covers both PKZIP for zseries and SecureZIP for zseries. PKZIP for zseries provides powerful, easy-to-use data compression on the mainframe. PKZIP for zseries Enterprise Edition additionally includes support for password-based decryption of encrypted files, powered by trusted RSA BSAFE. Files created by PKZIP for zseries use the widely-adopted ZIP format and can be accessed on all major platforms throughout the enterprise from mainframe to PC. SecureZIP for zseries provides powerful, easy-to-use data compression and data protection on the mainframe. SecureZIP for zseries delivers high performance data compression and protects data with digital signatures and trusted RSA BSAFE encryption, either password- or certificate-based, with key lengths of up to 256 bits. Like PKZIP for zseries, SecureZIP for zseries uses the widely-adopted ZIP format and creates files that can be accessed on all major platforms throughout the enterprise. Notices Licensing requirements have changed for this release. See Chapter 4 for details. About this Manual This manual provides the information needed to use PKZIP/SecureZIP for zseries in an operational environment. It is assumed that anyone using this manual has a good understanding of JCL and data set processing. This manual applies to the following operating systems: OS/390 Version 2.10 and above. z/os - all releases. Chapter 1. An introduction to both PKZIP/SecureZIP for zseries. Provides a general description of the product suite applicable to all supported platforms. This chapter also describes the features of the PKZIP/SecureZIP for zseries products and provides a simple description of how it is used to compress and decompress datasets. 1

14 Chapter 2. Provides a general discussion on data security along with specific implementations of encryption. Chapter 3. Provides more detailed examples of how specific file types should be processed by PKZIP/SecureZIP for zseries. This chapter also details the new features and functions introduced in various releases. Chapter 4. This chapter explains licensing of PKZIP/SecureZIP for zseries and provides information on invoking the 5-day grace period and disaster recovery tests. Chapter 5. Provides general information on invoking PKZIP/SECZIP and PKUNZIP/SECUNZIP, the main component programs of PKZIP/SecureZIP for zseries. This chapter explains the details associated with compression, decompression, restrictions, migration, and an overview of ZIP processing. Chapter 6. Provides details on security and authentication, including ISPF screen images and examples. Chapter 7. Provides a summary of ZIP file processing procedures, including filtering, file selection, requests, and the basic essentials for running the ZIP and UNZIP programs. Chapter 8. Explains ZIP file formats (text or binary), files attributes, and file size considerations. Chapter 9. Provides information about the types of files that are supported by PKZIP/SecureZIP for zseries, such as sequential files, PDS, or PDSE members, and VSAM files. Chapter 10. A reference covering the PKZIP/SecureZIP for zseries commands and messages. Chapter 11. Explains the possible states of an archive during processing and the functions of associated formats. Chapter 12. Provides an overview of how to process GZIP files and archives, including information about GZIP restrictions and extensions. Chapter 13. Provides instructions on the use of other facilities provided with PKZIP/SecureZIP for zseries, specifically the ISPF panel interface, to include setting options for configuration, defaults, and viewing archives. Chapter 14. Provides information on the User Application Programming Interface or USER API. Chapter 15. Provides information on calling PKZIP/SECZIP and PKUNZIP/SECUNZIP. Chapter 16. Provides information about the PKWARE PartnerLink program Appendix B. Sample Jobstreams Appendix C Installation JCL Appendix D. Making Code Page Translate Tables Appendix E. FIPS-197 AES Certification Appendix F. Contact Information Glossary. Explains terms related to compression and encryption 2

15 Conventions Used in This Manual Throughout this manual, the following conventions are used: PKZIP z (bold-italicized) refers to both PKZIP for zseries and SecureZIP for zseries. Information given for PKZIP z applies to both products. Information given specifically for PKZIP for zseries or SecureZIP for zseries applies specifically to that product. The use of the Courier font indicates text that may be found in job control language (JCL), parameter controls, or printed output. The use of italics in a command line indicates a value that must be substituted by the user, for example, a data set name. Italics are also used in body text to quote command names and so forth or to indicate the title of a manual or other publication. Bullets ( ) indicate items (or instructions) in a list. The use of <angle brackets> in a command definition indicates a mandatory parameter. The use of [square brackets] in a command definition indicates an optional parameter. A vertical bar ( ) in a command definition is used to separate mutually exclusive parameter options or modifiers. When sample JCL is shown, or references to the PKZIP z libraries are made, the high-level qualifier PKWARE.MVS may be used generically. The high-level qualifiers for the packaged products are PKZIP.MVS for PKZIP for zseries and SECZIP.MVS for SecureZIP for zseries). Also, please note that the actual high-level qualifiers installed on your system may be different. Program examples may show either SecureZIP or PKZIP constructs. In general, examples apply to both programs unless the examples appear in sections of the manual that relate exclusively to SecureZIP features. Such sections are marked like this: Requires SecureZIP PKZIP and SecureZIP Manuals PKZIP for Series and SecureZIP for zseries product manuals include: PKZIP/SecureZIP for zseries User s Guide - Provides detailed information on the product set in OS/390 and z/os operating environments. Provides a general introduction to data compression, PKZIP-specific data compression, and an overview of how to use PKZIP z control cards, and parameters. Provides SecureZIP-specific security extension information. PKZIP/SecureZIP for zseries Messages and Codes Guide - Provides information on the messages and codes that are displayed on the consoles, printed outputs, and associated terminals. 3

16 PKZIP/SecureZIP for zseries System Administrator s Guide - Provides detailed information to assist the system administrator to install and manage PKZIP z in an operational environment. Topics include: o o o o o System planning and administration Installation, licensing and configuration Verifying the installation Security administration overview (SecureZIP) Certificate store management (SecureZIP) Related Publications IBM Manuals relating to the PKZIP z products include: System Codes - Documents the completion codes issued by the operating system when it terminates a task or an address space. Describes the wait state codes placed in the program status word (PSW) when the system begins a wait state. Describes the causes of loops. System Messages - Documents the messages issued by the OS/390 operating system. The descriptions explain why the component issued the message, give the actions of the operating system, and suggest responses by the applications programmer, system programmer, and/or operator. JES2 Messages - Documents the messages issued by the JES2 subsystem. The descriptions explain why the component issued the message, give the actions of the operating system, and suggest responses by the applications programmer, system programmer, and/or operator. JCL User's Guide - Describes the job control tasks needed to enter jobs into the operating system, control the system's processing of jobs, and request the resources needed to run jobs. To perform the tasks, programmers code job control statements. The user's guide assists in deciding how to perform job control tasks. JCL Reference - Describes the job control tasks needed to enter jobs into the operating system, control the system's processing of jobs, and request the resources needed to run jobs. To perform the tasks, programmers code job control statements. The reference guide; is designed to be used while coding the statements. Access Methods Services - Documents the functions that are available with Virtual Storage Access Method (VSAM) and describes the IDCAMS commands that can be issued to control VSAM datasets. TSO/E Command Reference - Documents the functions of the TRANSMIT and RECEIVE Command Facility used for the distribution and allocation of PKZIP z installation libraries. MVS/QuickRef 6.3 (Chicago-Soft, Ltd.) - Includes both messages and command reference material for PKZIP z. 4

17 Related Information on the Internet PKWARE, Inc. FTP site Product manuals - ftp://bigiron.pkware.com/pub/manuals/zseries Product downloads - ftp://bigiron.pkware.com/pub/products o PKZIP for zseries - ftp://bigiron.pkware.com/pub/products/pkzip/zseries o SecureZIP for zseries - ftp://bigiron.pkware.com/pub/products/securezip/zseries o PartnerLink Reader/SecureLink - ftp://bigiron.pkware.com/pub/products/partnerlink/zseries National Institutes of Standards Computer Security Resource Center - Information on the AES development - Information on Key Management - RSA BSAFE Content Library User Help and Contact Information For Licensing, please contact the Sales Division at or PKSALES@PKWARE.COM. For technical assistance, please contact Technical Suppport. Appendix F lists the types of information needed to resolve issues with the product. 5

18 1 An Introduction to PKZIP and SecureZIP for zseries Built on the award-winning PKZIP, SecureZIP for zseries enables you to create and extract ZIP archives and archives of other types and, with the new security features, to use passwords and/or digital certificates to strongly encrypt archives and archived files. Strong, digital certificate-based encryption enables you to encrypt files just for the people you want to see them. With its advanced password and certificate-based security features, SecureZIP for zseries offers multiple methods of encryption and is an excellent choice for secure messaging and storage. Like PKZIP, SecureZIP for zseries offers various methods and levels of compression and a host of other powerful features. Note: Both PKZIP for zseries and SecureZIP for zseries can apply strong password-based encryption, and all current PKZIP desktop products recognize digital signatures and can decrypt strongly encrypted files. However, to do strong, certificate-based encryption requires the premium, SecureZIP for zseries edition. SecureZIP for zseries can access certificates in directory servers via an LDAP compliant interface. In addition, it can look for certificates in LDAP certificate stores. These stores can automatically be searched for recipients to whom you are sending an message so that you can use their keys when encrypting an attachment. This feature requires the separately licensed Directory Integration module. The Directory Integration module enables you to access certificates stored in remote directories as well as certificates on the local machine. This extends your ability to work with certificates that belong to your colleagues in the enterprise as well as customers, partners, and vendors. PKZIP z contains two main programs: PKZIP (or SECZIP in SecureZIP) and PKUNZIP (or SECUNZIP in SecureZIP). The ZIP program compresses or otherwise stores files into a ZIP format archive; the UNZIP program extracts files compressed into ZIP-compatible archives. Processing control is available through the use of customized option modules, shared command lists, and individual job inputs. In addition to file selection, features such as compression levels and performance selections can be specified. SecureZIP for zseries is also available in a special version SecureZIP Reader/SecureLink through the PKWARE PartnerLink program. The PKWARE PartnerLink program provides a straightforward, secure way for an organization to exchange sensitive information with outside partners who perhaps do not have SecureZIP. 6

19 SecureZIP Reader/SecureLink differs from the full SecureZIP for zseries in that it only extracts archives from, and only creates and encrypts archives for, a PartnerLink sponsor. Contact PKWARE for more information on PKWARE PartnerLink. To guarantee data integrity, 32-bit Cyclic Redundancy Check (CRC) is a standard feature for all products. A ZIP archive is platform-independent; therefore, data compressed (zipped) on one platform, such as UNIX or Windows, can be decompressed (unzipped) on another platform, such as OS/390 or z/os by using a compatible version of the UNZIP program. Data Compression Data compression reduces file size. A compressed data file uses less storage space and can be transferred faster. A data file to be compressed (a ZIP candidate) is compressed to a compact size (ZIPPED file). To use the file again, it must be uncompressed or extracted to its original size (UNZIPPED file). For example, a simple data compression technique is the Run-Length Encoding method. This method works when repeating characters are evident in a data stream. The run of characters is represented in a compressed form as a single character with its count. Example: B E H H H H H H H H H Compressed: B *4 2 E H*9 However, to perform a thorough compression operation, more advanced algorithms and enhanced techniques are required which work at the bit level and allow for noncontiguous iterations of bit strings. PKZIP z uses such methods to achieve maximum results. ZIP Archives PKZIP z stores compressed data files into ZIP archives. There is no limit to the number of archives you may create. A ZIP archive refers to any valid ZIP-format file created by a ZIP-compatible product. PKWARE's Application Note on the.zip file format provides developers a general description and technical details of the ZIP specification. This specification is periodically revised according to the publication policy statement as new features are added to ensure the continued interoperability of ZIP applications. With the ZIP64 feature available in SecureZIP for zseries and PKZIP for zseries (Enterprise Edition) release 5.6 and higher, over 4 billion files can be managed within a single archive. The ZIP archive architecture supports Exabyte (64-bit) sizes for files in an archive. ZIP archives themselves can exceed 4 gigabytes for specified access methods and device media. With ZIP products prior to release 4.5 (and PKZIP for MVS products), an archive can store up to 65,535 files. File sizes of less than 4 gigabytes in size can be compressed, and an archive is limited to less than 4 gigabytes in size. For each file in an archive, the following information is stored with the compressed data: 7

20 Filename File directory date and time File s initial CRC value. See Cyclic Redundancy Check Method of compression used ZIP Version required for file extraction File size, uncompressed File size, compressed Some files may contain the following additional information: The version of ZIP that created the file File attributes A comment about the file A comment about the archive Platform specific attributes (see Cross Platform Compatibility) Cyclic Redundancy Check A Cyclic Redundancy Check (CRC) is performed to check the integrity of a data file when it is restored from a ZIP archive. While a file is compressed, a PKZIP z algorithm computes a 32-bit hexadecimal value for its data. That CRC value is stored with the file in the ZIP archive. When the data in the file is extracted, PKZIP z processes it again by the same algorithm to produce a second CRC value and compares the two. If the data has not changed, the values will be the same. If the two CRC values do not match, data may have been corrupted in the ZIP archive during file transfer operations, and PKZIP z reports the failure. Distinctive Features of PKZIP and SecureZIP for zseries Distinctive features of SecureZIP for the z/os and OS/390 operating environments include: Ability to process execution from ISPF Panels, as a TSO/E command, within TSO/E REXX EXECs or CLISTs, from an application program, or a stand-alone batch utility. A robust ISPF panel interface that displays the ZIP archive directory in a table format and enables selection of individual archived (zipped) files for browsing, viewing, extracting, or deleting. Compression and extraction of datasets of the following types on DASD: Sequential files. PDS and PDSE members. VSAM files (KSDS, ESDS, RRDS). JES2 subsystem input files (for example, //ddname DD *). 8

21 Command extensions allowing greater flexibility in file selection. Unique filename translation to/from system/390 DSNAME conventions and the UNIXstyle names typically found in zip archives. Compressing and extracting of datasets of the following types on tape or cartridge: Sequential files. Compressing and extracting of files to OS/390 and z/os Load Libraries. Compressing and extracting of files to Generation Data Groups (GDGs). GDG files can be used as a ZIP archive. Retention of dataset allocation information, such as dataset organization, device type, and DCB/Cluster attributes. Preservation of this information allows for duplication of the file with the same characteristics during the UNZIP process. Support of ZIP archives within the following dataset organizations: Sequential files (DASD, Tape, or Cartridge). PDS and PDSE members. VSAM ESDS. Selection of datasets for processing based upon user-specified control statements, DD JCL specifications, or user-defined filtering lists. Execution on OS/ and higher. SecureZIP also executes on a z/os system IPL d in 64-bit mode. Execution in AMODE 31, using storage primarily above the 16-Mb line. However, certain operating system control blocks and system services require virtual storage below the 16-Mb line. The amount of virtual storage available within each of these areas of an address space will limit the use of some performance options (for example, multi-tasking and temporary files in storage) and capabilities. Defaults customizable during installation. Multiple defaults modules may be created for use in a variety of application needs. Use of pre-defined command files saved in a place selected by the user or system administrator. These can be referenced by multiple jobs or users, thus eliminating the need for individual JCL command streams, or used in combination with individual job inputs to provide a consistent set of processing controls. Certain features of PKZIP for zseries are separately licensed (see Chapter 4). Distinctive Features of SecureZIP for zseries Distinctive features of SecureZIP for the z/os and OS/390 operating environments include: Ability to access certificates in directory servers through an LDAP-compliant interface. SecureZIP can look for certificates in LDAP certificate stores and automatically search these stores for recipients to whom you are sending an message so that you can use their keys when encrypting an attachment. (Requires the optional Directory Integration module.) Certain features of SecureZIP for zseries are separately licensed (see Chapter 4). 9

22 Encryption Using Passwords and/or Digital Certificates Requires SecureZIP SecureZIP for zseries can encrypt data for security control with digital certificates and/or provide a password lockout for extracting data. Varying security levels are available with multiple encryption algorithms. See Chapter 2 for a complete description of security features in SecureZIP for zseries. Cross Platform Compatibility PKZIP z was designed for cross-platform use and enables you to move data among different computer operating environments. Archives created with PKZIP/SecureZIP for zseries are compatible with, PKZIP for MVS, PKZIP/SecureZIP for iseries, PKZIP for OS/400, PKZIP/SecureZIP for UNIX, PKZIP/SecureZIP for LINUX, PKZIP for DOS, and PKZIP/SecureZIP for Windows. All of these products use the the same ZIP archive file format and can work with each other s archives. As a result, data can be zipped on one platform for example, UNIX and unzipped onto another platform, such as OS/400. PKZIP z automatically converts the data between EBCDIC and ASCII, so files prepared on the host are readable on any PC or UNIX system. The following table lists ZIP features supported on different platforms and the version of the ZIP file format Application Note where the features appear. In the table, (EE) refers to PKZIP for zseries Enterprise Edition. 10

23 ZIP Feature ZIP AppNote Version MVS/zSeries OS400/iSeries Default 1.0 File represents a volume label 1.1 Not supported Not supported File represents a folder 2.0 Not supported Not supported Deflate compression x 2.x Traditional encryption x 2.x Deflate64 compression DCL Implode compression 2.5 Not supported Not supported File is a patched data set 2.7 Not supported Not supported File uses ZIP64 size extensions BZip2 compression 4.6 Not supported Not supported DES encryption DES encryption RC2 encryption 5.0 Not supported Not supported RC4 encryption AES encryption DES decryption 5.0 SZ8.2, PK8.2(EE) SZ8.2, PK8.2(EE) 3DES decryption 5.0 SZ8.2, PK8.2(EE) SZ8.2, PK8.2(EE) RC4 decryption 5.0 SZ8.2, PK8.2(EE) SZ8.2, PK8.2(EE) AES decryption 5.1 SZ5.5, PK8.2(EE) SZ5.5, PK8.2(EE) Certificate encryption using non-oaep key wrapping Central directory encryption (file name encryption) (SecureZIP) 8.2 (SecureZIP) (SecureZIP) 8.2 (SecureZIP) If you want to transfer data across platforms using any other ZIP compatible product, you should check with the supplier first to confirm which versions of PKZIP it is compatible with. 11

24 2 Introduction to Data Security In this chapter we will detail how SecureZIP for zseries can strongly encrypt data for security control and protection. Much of the reference information in this chapter is from the National Institutes of Standards and Technology. The NIST Computer Security Resource Center web site, contains FAQs and documentation relating to computer security along with the Federal Information Processing Standard (FIPS) documents. The PKWARE web site, also contains information relating to security and links to the RSA Security, Inc., Web site that provides detailed information on the BSAFE implementation used in SecureZIP for zseries. The following sections describe encryption, types of algorithms: in use, information about specific mandates requiring the use of secure data, and how SecureZIP for zseries secures that data. Examples are provided in Chapter 6. See Chapter 10 for documentation for the commands. Note: PKZIP for zseries provides support for password-based encryption and decryption using a 96-bit Standard encryption algorithm that is supported by older ZIP-compatible utilities. PKZIP for zseries Enterprise Edition supports the decryption of all password-based algorithms provided in SecureZIP for zseries. SecureZIP for zseries Security Basics SecureZIP for zseries security functions include strong encryption tools using RSA BSAFE and the PKWARE implementation of the Advanced Encryption Standard. SecureZIP for zseries provides the option for password encryption using RC4, DES, 3DES and AES. SecureZIP for zseries uses a multi-layer key generation process, based on a user-specified password of up to 250 characters, and/or a users digital certificate, that creates a unique internal key for each file being processed. The same password will result in a different systemgenerated key for each file. SecureZIP for zseries also implements Cipher Block Chaining (CBC) to further enhance industry standard encryption algorithms. This feature ensures that each block of data is uniquely modified, further protecting the data from fraudulent access. SecureZIP for zseries encryption is activated through the use of the PASSWORD and RECIPIENT commands. If a value is present for either setting, whether through commands or default settings, then encryption will be attempted in accordance with other settings (for 12

25 example, ENCRYPTION_METHOD). However, if ENCRYPTION_METHOD=NONE is specified, then encryption will be bypassed. Archives created under PKZIP for Windows and PKZIP for UNIX using the encryption setting Strong: Recipient List or Password can be decrypted with the password on zseries systems running release 8.0 or later. SecureZIP for zseries signing and authentication features are activated through the use of the SIGN_ARCHIVE, SIGN_FILES and AUTHCHK commands. Operating System Levels OS/ or any zos release is required to run certificate-based operations. If your operating system is not at this level, you will receive the message, ZPEN100E Certificate- Based functions require a minimum operating system. You will receive a RC=12. Digital Certificate Formats Requires SecureZIP SecureZIP for zseries requires that X.509 certificates be used and that they conform to specific formats depending on the type being accessed or administered. See the section Setting Up Stores for Digital Certificates on zos, later in this chapter, for more information. SecureZIP for Windows Compatibility Windows users running pre-xp versions of Windows may experience a problem decrypting depending on the way in which private-key certificates are imported on the system. Unless the dialog check box Mark the private key as exportable is selected when certificates are imported on pre-xp Windows, Windows will allow an AES encrypted file to be decrypted only if the master session key is wrapped with 3DES. A new command, Secure_OPT_MSK3DES, is introduced with RECIPIENT processing which allows the SecureZip user to create AES-encrypted files that are compatible with older Windows workstations. When turned on, the MSK3DES flag is set in the NDH/DIB, indicating that the master session key information is protected with 3DES when recipients are specified. PKZIP for Windows has a variance in processing for versions 6.0 and 7.x because of an issue with OAEP encryption processing. PKZIP for Windows 5.0 through 6.0 used OAEP. However, OAEP was found to be incompatible with smart cards, so versions 6.1 and later set a NO_OAEP flag in the NDH/DIB flags and no longer create OAEP encryption-mode files by default. SecureZIP for zseries always sets NO_OAEP; therefore, PKZIP for Windows will not be able to read recipient-list encrypted files from the large platforms. SecureZIP for zseries should be able to detect whether the NO_OAEP flag is set and successfully extract in either case. No change in logic is required within the SecureZIP highlevel code, but the low-level EVTCERTD code should handle the switch based on the flag. 13

26 General Information to Help You Get Started How do I activate encryption in SecureZIP for zseries? Encryption is activated through the use of the PASSWORD (and/or RECIPIENT for SecureZIP) commands. If a value is present for either setting, whether through commands or default settings, then encryption will be attempted in accordance with other settings (such as ENCRYPTION_METHOD). However, if ENCRYPTION_METHOD=NONE is specified, then encryption will be bypassed. Note that certificate-based encryption for recipients is only supported by SecureZIP, not by PKZIP versions of the product. Also, this mode of encryption requires that one of the strong encryption methods (minimum 128-bit) be selected. How do we activate MASTER_RECIPIENT Contingency Keys? To meet the needs of corporate security policies, SecureZIP provides the ability to use the MASTER_RECIPIENT setting to include one or more master recipient contingency key certificate files in a SecureZIP job when strong encryption is activated. The setting causes the data to be encrypted for the master recipient(s) in addition to other recipient or password settings, thereby ensuring that the organization can always decrypt its encrypted data. The primary MASTER_RECIPIENT may be set directly in the defaults module, or indirectly by specifying MASTER_RECIPIENT in a command stream referenced by SECUREZIP_CONFIG. This default-module-only setting specifies a PDS[E] member that contains SecureZIP certificate store configuration commands to be automatically included in the processing stream. The configuration command values from this member are included at the start of command input processing, before //SYSIN statements are read. The data set(member) is internally converted into an "INCLUDE_CMD=(pds[e](member)" command and is echoed to the message log in accordance with the ECHO setting. The primary MASTER_RECIPIENT is reported in the SHOW_SETTINGS report. Supplemental MASTER_RECIPIENT commands may be provided via the primary SYSIN input stream or indirectly from either the SECUREZIP_CONFIG or INCLUDE_CMD specifications. They will be internally converted to RECIPIENT commands for processing. MASTER_RECIPIENT settings are cumulative. Therefore a setting in the defaults module is not overridden or eliminated from an execution. How does the MASTER_RECIPIENT contingency key setting affect processing? When SecureZIP is used to encrypt data, either with RECIPIENT or PASSWORD, then a recipient specified by MASTER_RECIPIENT will be automatically included. However, MASTER_RECIPIENT does not trigger encryption. How does recipient-based encryption differ from password? Password-based encryption depends on both the sender and receiver knowing, and providing input (the password), in clear text. The password is used to derive a binary master session key for each decryption run. No key information is kept within the ZIP archive, therefore both parties must retain the password in an external location. Recipient-based encryption provides a means by which the master session key (MSK) information can be hidden, protected, and carried within the ZIP archive. This is done by using 14

27 technique known as digital enveloping with public key encryption. The technique requires that the creating process have a copy of the recipient's public key digital certificate, which is used to protect and store the MSK. The receiving side must have a copy of the recipient's private key digital certificate. With these two pieces of information in place, there is no need for users to retain or recall a password for decryption. What is a Digital Certificate Store? Requires SecureZIP Recipient-based encryption requires that public and private key certificates be used by SecureZip for zseries. These are kept in file streams encoded according to the X.509 standard. A certificate store is the location of where various types of certificates are kept and accessed. The primary stores used by SecureZip for zseries include: CSPUB: Certificate store for individual public-key X.509 certificates on the local system. CSPRVT: Certificate store for individual private-key X.509 certificates on the local system. CSCA: Certificate store for certificate authority public-key X.509 certificates on the local system. CSROOT: Certificate store for the trusted root public-key X.509 certificates on the local system. LDAP: Certificate store for individual public-key X.509 certificates accessible via a TCPIP network. Can both recipient-based and password encryption be used together? Yes. When both RECIPIENT and PASSWORD settings are used, to encrypt a file, the master session key is derived from the password and is also protected by using public key encryption. This means that the file can be decrypted either by supplying the password or by providing access to a private key associated with a public key used to encrypt. How does ENCRYPTION_METHOD pertain to recipient or password encryption? Public/private key encryption using BSAFE digitally envelopes the master session key information. Once the master session key is determined, an independent file session key is derived (which is unique for each file) to encrypt the file data with a symmetric algorithm specified by ENCRYPTION_METHOD. Several algorithms are supplied with SecureZip for zseries. Any algorithm may be specified for use with a password, but only those prefixed with BSAFE are valid for use with recipient-based encryption. Which encryption settings should I choose? Various external factors such as legislative requirements or corporate policy may influence your selection an algorithm or mode of encryption. However, in general, certificate-based encryption is considered more secure than password-based encryption. 15

28 Except for the older 96-bit Standard SecureZip for zseries encryption algorithm, encryption algorithms are provided at a minimum of 128 bits. PKWARE supports interoperability among OS/390, zos, OS400, iseries, UNIX and Windows for all algorithms provided with ENCRYPTION_METHOD for PKWARE products at release 8.0 and later. Older releases of PKWARE products support Standard 96-bit encryption. When RECIPIENT PKI exchanges are required, then ENCRYPTION_METHOD must specify an algorithm whose name begins with BSAFE. Password-based AES encryption is supported by PKWARE products at release 5.5 or higher. BSAFE_AES and AES password-based encryption are 100% compatible. Archives created with PKZIP for zseries Release 5.5 can be bi-directionally exchanged with SecureZip or PKZIP products using the BSAFE AES algorithms. The BSAFE algorithms provided for the OS/390 and zseries products are high-performance algorithms. The 128-bit BSAFE algorithms out-perform the older 96-bit PKZIP Standard algorithm. How many recipients can be specified? The ZIP file format specification allows for a maximum list size of 3,275 recipients. This can be restricted further by other file attributes associated with the data and by run-time capacity limitations (such as virtual storage). (Approximately 20 bytes are required for each recipient within the ZIP archive central directory record for each file. This area is limited to 64K in size). What are digital signatures? A digital signature is an unforgeable mechanism that ensures that the file to which it is attached originates from the owner of the signature and is unchanged since it was signed. The private key from a user s digital certificate is used to attach a digital signature. The signature is authenticated by application of the public key from the certificate. Files in a ZIP archive can be digitally signed, and an archive itself can be digitally signed. An archive is signed by attaching a signature to its central directory, which contains archive meta-data, including the list of files in the archive. A signed ZIP archive can contain files that are signed or unsigned (or both). Signing an archive enables people who receive it to confirm that the archive as a whole is not changed. Signing only files in an archive enables people to confirm that the individual signed files are unchanged but does not guarantee that files have not been added or removed. SecureZIP for Windows can use certificates to sign files and to authenticate digital signatures on files that you receive from others. SecureZIP for zseries provides an informational message that a ZIP archive central directory signature exists. SecureZIP for zseries prevents a ZIP archive from being altered in-place when its central directory is signed. What is file name encryption? Someone who cannot decrypt the contents of an archive may still be able to infer sensitive information just from the unencrypted names of files. To prevent this, you can encrypt the names of files in addition to their contents. Encrypted file names can be viewed in the clear that is, unencrypted only when the archive is opened by an intended recipient, if the archive 16