Overview
You can have full disk encryption. This prevents the disk from being read if it is removed from the environment. The disk subsystem requests the keys from a key manager, not z/OS, as the disk subsystem is doing the encryption and decryption. The keys are requested at power on of the disk subsystem.
On z/OS you can have data set encryption. The data set contents are encrypted on disk. Each data set could have a unique encryption key. Users on the system need permission to read the data set, and need access to the encrypt key.
If a userid is permitted to the data set, and to the encryption key, the userid has access to the data and can read and write it, the same was as if the data set was not encrypted.
Once you have set up the definitions, they are used when the data set is created. To encrypt a data set, you can…
- Create a new (encrypted) dataset
- Copy the old to the new.
- Delete the old, and rename the new to old.
If you delete the key, then the data is not accessible unless you have a backup of the key – or you have a copy of the key on another system.
This encryption does not apply to files in Unix System Services, because these are not RACF protected.
MQ 9.2 and later supports encryption, including for page sets and log data sets. See here. DB2 can use data set encryption for its page sets and logs, see here.
Topics
Implementation
You create an encryption key using the ICSF component on z/OS.
ISPF interface
If you are using the ICSF ISPF interface use options use : 5 Utility, 5 CKDS Keys, 7 Generate AES DATA keys. In the field Enter the CKDS record label for the new AES DATA key enter a memorable name. In the Red book, it uses a prefix of DATASET.name , I used COLINAES.
In AES key bit length: select 256 – other values give errors.
Batch interface
Use the operator command d icsf,kds to display the current datasets being used by ICSF. It gave me CSF.CSFCKDS.NEW .
The JCL below deletes the key, and creates a new key. It then refreshes the in memory data. (Once you delete the key, any data sets which used it cannot be read).
//IBMICSF JOB 1,MSGCLASS=H
//STEP10 EXEC PGM=CSFKGUP
// SET CKDS=CSF.CSFCKDS.NEW
//CSFCKDS DD DISP=OLD,DSN=&CKDS
//* LENGTH(32) GENERATES A 256 BIT KEY
//CSFIN DD *,LRECL=80
DELETE TYPE(DATA) LABEL(COLINBATCHAES )
ADD TYPE(DATA) ALGORITHM(AES),
LABEL(COLINBATCHAES ) LENGTH(32)
/*
//CSFDIAG DD SYSOUT=*,LRECL=133
//CSFKEYS DD SYSOUT=*,LRECL=1044
//CSFSTMNT DD SYSOUT=*,LRECL=80
//* Refresh the in memory data
//REFRESH EXEC PGM=CSFEUTIL,PARM='&CKDS,REFRESH'
This gave
CSFG0321 STATEMENT SUCCESSFULLY PROCESSED.
CSFG0780 A REFRESH OF THE IN-STORAGE CKDS IS NECESSARY TO ACTIVATE CHANGES MADE BY KGUP.
and the refresh gave
CSFU002I CSFEUTIL COMPLETED, RETURN CODE = 0, REASON CODE = 0
Security profiles
The encryption information is used when the data set is created. This can be specified in JCL, VSAM DEFINE, or in the DFP extension of a dataset RACF profile.
Create and use the encryption key profiles
Use batch TSO. The statements below:
- Uses SET to define the variable, as it is used in several places
- Delete the old profile (there is no define replace)
- Create the profile
- Give userid IBMUSER read access to the profile
- Refreshes the RACLIST information
- Alters the data sets profile to set the DFP segment to use the key just defined
//IBMRACF2 JOB 1,MSGCLASS=H
// EXPORT SYMLIST=*
// SET KEY=COLINAES
//S1 EXEC PGM=IKJEFT01,REGION=0M
//SYSPRINT DD SYSOUT=*
//SYSTSPRT DD SYSOUT=*
//SYSTSIN DD *,SYMBOLS=JCLONLY
RDELETE CSFKEYS &KEY
RDEFINE CSFKEYS &KEY +
ICSF(SYMCPACFWRAP(YES) SYMCPACFRET(YES)) +
UACC(NONE)
PERMIT &KEY +
CLASS(CSFKEYS) ID(IBMUSER ) +
ACCESS(READ)
SETROPTS RACLIST(CSFKEYS) REFRESH
RLIST CSFKEYS &KEY AUTHUSER ICSF
ALTDSD 'COLIN.ENCR.*' UACC(NONE) +
DFP(DATAKEY(&KEY))
/*
//* LISTCAT ENTRIES('COLIN.ENCR.DSN') ALL
This encryption information is only used when a data is created.
If you use LISTCAT, it will show old information, until the data set is recreated.
More set up
When I tried creating a data set with the encryption label I got
IEF344I IBMRACF2 S3 DD2 - ALLOCATION FAILED DUE TO DATA FACILITY SYSTEM ERROR
IGD17157I DSNTYPE BASIC IS NOT A SUPPORTED DATA SET TYPE FOR ENCRYPTION
BECAUSE STGADMIN.SMS.ALLOW.DATASET.SEQ.ENCRYPT IS NOT DEFINED
IGD17151I ALLOCATION FAILED FOR DATA SET
COLIN.ENCR.DSN BECAUSE A KEY LABEL IS
SPECIFIED FOR AN UNSUPPORTED DATA SET TYPE.
See Specifying a key label for a non-extended format data set.
You can either use an SMS DC with Extended Format specified, or define the RACF resource
STGADMIN.SMS.ALLOW.DATASET.SEQ.ENCRYPT.
TSO RDEFINE FACILITY STGADMIN.SMS.ALLOW.DATASET.SEQ.ENCRYPT
TSO SETR RACLIST(FACILITY) REFRESH
Use the definitions with a dataset
You can specify the encryption key reference in
- JCL using DSKEYLBL
- Via a RACF data set profile and the DFP extension
- DEFINE IDCAMS, with KEYLABEL(MYLABEL)
- SMS definitions
If there is no DFP segment to the RACF profile you can use
//SYSUT2 DD DSN=COLIN.ENCR.DSN,SPACE=(CYL,(1,1)),
// DSKEYLBL=COLINBATCHAES,
// DISP=(MOD,CATLG),
// DCB=(RECFM=FB,LRECL=80,BLKSIZE=800)
In the JCL output it has
IGD17150I DATA SET COLIN.ENCR.DSN IS ELIGIBLE FOR ACCESS METHOD ENCRYPTION. KEY LABEL IS (COLINBATCHAES)
LISTCAT output gave
LISTCAT ENTRIES('COLIN.ENCR.DSN') ALL
NONVSAM ------- COLIN.ENCR.DSN
IN-CAT --- A4USR1.ICFCAT
HISTORY
...
SMSDATA
...
ENCRYPTIONDATA
DATA SET ENCRYPTION----(YES)
DATA SET KEY LABEL-----COLINBATCHAES
Doing interesting things with encrypted data sets
You can use DFDSS to copy the encrypted dataset, without decrypting it. Any encryption parameters are copied to the new data set.
You need access to the CSFKEYS profile.
The JCL below
- Deletes the old data set
- Copies from COLIN.ENCR.DSN creating the output renaming COLIN to ADCD
- List the catalog for the output data set
//IBMDFDSS JOB 1,MSGCLASS=H
//S1 EXEC PGM=IEFBR14,REGION=0M
//SYSPRINT DD SYSOUT=*
//DDOLD DD DSN=ADCD.ENCR.DSN,SPACE=(CYL,(1,1)),DISP=(MOD,DELETE)
//*
//S1 EXEC PGM=ADRDSSU,REGION=0M PARM='TYPRUN=NORUN'
//SYSPRINT DD SYSOUT=*
//SYSIN DD *
COPY -
DATASET(INCLUDE(COLIN.ENCR.DSN)) -
REPLACE -
RENUNC(ADCD )
/*
//S1 EXEC PGM=IKJEFT01,REGION=0M
//SYSPRINT DD SYSOUT=*
//SYSTSPRT DD SYSOUT=*
//SYSTSIN DD *
LISTCAT ENTRIES('ADCD.ENCR.DSN') ALL
/*
The userid(COLIN) that ran this job had permission to read the data set, and has access to the key.
The output data set has
ENCRYPTIONDATA
DATA SET ENCRYPTION----(YES)
DATA SET KEY LABEL-----COLINBATCHAES
The data set has been copied encrypted with the same key as the original data set.
You can print the encrypted data in the file using DFDSS (ADRDSSU) PRINT DATASET(..) command.
Other questions
Does the size of the data set change?
It looks like the encrypted dataset is the same size as the unencrypted data set.
What happens if I delete and recreate the encryption key?
DFDDSS COPY worked (RC 0) – but gave a message IEC143I 213-91 which means the label points to a different key.
If I try to read the copied data set, I get the same message. The data set can be copied, but cannot be decrypted.
The key has been thrown away, and the contents are unreadable unless you have a backup of the key, or have a copy of the key on another system.
ColinPaice 