Defining Keys in Parmlib › How Key Management Works

How Key Management Works

The unique key management features of CA Tape Encryption provide secure control for the entire life cycle of the keys used for encrypting tapes. Keys are managed in the following ways:

• All key management is designed so that keys are never available to users as clear text.

  Note: CA Tape Encryption cannot ensure that clear keys are never available to users if keys are stored in the CKDS.

• CA Tape Encryption tracks all key usage and interfaces with the tape management system to deactivate keys when they are no longer needed.
• The ICSF CKDS or the BES database, or both, retain and manage all keys, including:
  • Symmetric keys for in-house tapes.
  • Temporary symmetric keys for single-use encryption of B2B tapes.
• If you use the BES database as the key repository, it tracks and maintains symmetric keys for in-house tapes. If you use the CKDS as the key repository, CA Tape Encryption interfaces to it to save keys in the CKDS. Even when you use the CKDS, the BES database stores additional information about keys.
• Code books are always stored in the BES database regardless of which database is selected as the primary key repository, the BES database or the ICSF CKDS.
• For digital-certificate-based B2B tapes, the digital certificate of the business partner is used to obtain the public key of the partner's public key/private key pair. The digital certificate is specified in the DFSMS data class description along with the type of encryption requested. The security administrator uses the B2BKeyrings attributes to provide the names of the key rings where the digital certificates are defined to the security system.
• For each key name the security administrator defines, CA Tape Encryption does the following:
  • Generates, tracks, and maintains all past and present keys
  • Maintains a specified number of future symmetric keys
  • Stores each key in the ICSF CKDS or BES database
• Symmetric keys are generated in advance based on the interval specified by the Regenerate attribute in parmlib. When a key is replaced by the regeneration process, the following occurs:
  • Another key is generated and the database is updated to retain a constant number of available keys.
  • A new key is immediately available. However, keys are used in the order in which they are generated. If six key generations are specified and are defined to be generated weekly, the new version of a key will not be used for six weeks, as shown in the following sample parmlib attributes:

    NumberofGenerations=6
    Regenerate=Weekly
    

  Note: The key label always refers to the currently active key.

• A deactivated key is retained in the CA Tape Encryption database and the ICSF database until the last tape that was encrypted with that key is no longer needed.
  • CA Tape Encryption integrates with CA 1, CA TLMS, and DFSMSrmm to track key usage.
  • CA Tape Encryption Option for Third Party TMS provides an interface for other tape management systems to track key usage and to notify CA Tape Encryption when the key is no longer in use.
• For B2B tapes, a new temporary symmetric key is generated for each encrypted file.
  • This symmetric key is encrypted under the public key of the business partner when the digital certificate form of B2B tapes is selected, and is stored in a user header label on the tape so that it can be securely transmitted to the business partner.
  • For B2B tapes based on a code book, rather than storing the symmetric key on the tape, information about how to rebuild the key from the code book is stored on the tape.
• For symmetric keys defined as CA Encryption Key Manager managed keys (CAKMManaged = Yes), Digital Certificates are generated and stored in your security database and are maintained and managed using the same guidelines as symmetric keys, including generation, pre-generation, tracking and destruction.
• A copy of each Digital Certificate generated by the CA Encryption Key Manager is stored in the BES database unless the PKDS is selected via the IBMEKMKeysDataBase parameter; certificates stored in the PKDS cannot be exported out of the security database and therefore a copy of these certificates cannot be maintained in the BES database.