Performing Recovery Operations › TBEMIGRT Utility › How You Modify Your Configuration to Add a System With No CKDS Support

How You Modify Your Configuration to Add a System With No CKDS Support

If your site runs a production system with cryptographic keys stored in the ICSF CKDS, and you want to add another system, but that system does not support CKDS, you need to modify your CA Tape Encryption configuration. This is a situation where you are adding another system that shares DASD with the existing production system, and the new system does not have a cryptographic coprocessor. Therefore, it cannot support CKDS. If you have all your keys in CKDS, the new system will not be able to use them. You can modify your configuration as follows:

• Move keys from CKDS to a shared BES database so that the keys can be shared across all systems that perform tape encryption and decryption.
• Modify parmlib to use BES as the database for storing all keys.

  Note: For information about modifying parmlib, see the chapter “Defining System Options in Parmlib.”