z/OS Security and PKI services

EnvironmentDB2 V8 EngineSQL orUtility( Batch Job )DataEncryption( EDITPROC )z/OS 1.4+ with Features (*)Hardware CryptoFeature:- CEXC2 (z9-109)- PCXICC ( z990 )- CCF ( z900 )ICSF ServiceDB2TableDB2TableNo ENCRYPTIONCaseENCRYPTIONCase• IBM zSeries Processors ( z9-109, z990, z890, z900 )► Hardware Cryptographic Features which supports “Secure Key” (clear key with PQ94822 + PQ93943)● z9-109 : CEX2CC● z990 : PCIXCC● Z900 : CCF• IBM z/OS V1R4+ with following Features (*) installed;► z990 and z890 Enhancements to Cryptographic Support► z/OS V1R4 z990 Exploitation Support• IBM Middleware Products;► DB2 for z/OS Version 6 or higher► IMS, Version 6 or higherz9-109, z990 or z900 LPARDisks3007.04.2006 IBM SystemsInstallation Steps• Set up and validate crypto hardware► Validate? If from ICSF menu, Utility option for Random Number works, ICSF and secure crypto hardwareworks● Clear key support with APAR PQ94822 + PQ93943• Generate and then store (in the CKDS) a triple DES encryption key for use► Use ICSF Key Generation Utility Program, KGUP► Read ICSF Administrator's Guide• Build the IMS or DB2 user exit, specifying the key name defined in step above• Back up your data• Unload your data• Create/install the exit• Reload the data, during which process the data is encrypted• Validate your output3107.04.2006 IBM Systems