Deactivating Keys › Manage Compromised Keys

Manage Compromised Keys

CA Tape Encryption provides a special key status of Compromised to support FIPS processing requirements. Consider the following points for managing compromised keys:

• If the CA Tape Encryption system commands are protected by the external security manager, you must be permitted to the BESn.COMPROMISE OPERCMDS resource.
• Use the BESn COMPROMISE= console command to flag either the currently active version of a key or all versions of a key to be marked as compromised.

  Note: For more information about using the BESn COMPROMISE= console command, see the chapter “Defining Keys in Parmlib.”

  When a key instance is marked as compromised, the next pre-generated key for that key name is activated and a new key instance is automatically generated for future use.

• If you specify BESn COMPROMISE= ALL, all future keys are discarded. New instances of the keys are generated to ensure that the number of keys available for future use equals the number of keys specified in the NumberOfGenerations attribute.
• The compromised key is retained for decrypting any data that was already encrypted with this key.

Note: For more information about commands, see the Configuration Guide.