Managing Operations › BES Database Pass Phrase Protection › Pass Phrase Considerations

Pass Phrase Considerations

The BES database pass phrase or dual pass phrases protect all of the data in the database. Consider the following points for using the pass phrases:

• The value of the pass phrase can be any uppercase or lowercase character, including blanks and special characters, up to 32 characters in length.
• If using dual pass phrases specify PassPhraseCount=2 in the StartupOptions section of your Startup parmlib member. When PassPhraseCount=2 is specified, dual pass phrases will be required.

  CA recommends that two persons be responsible for a single pass phrase each. Internally, the two phrases are taken together to create a single master key for the BES database.

  Use the PassPhraseID1 and PassPhraseID2 StartupOptions attributes to specify role names such as “Security Administrator” or “Storage Administrator”. These names are used to identify which pass phrase is required when prompting for pass phrases.

• To convert a database currently using one pass phrase to use two pass phrases, update the StartupOptions section with PassPhraseCount=2. The next time the BES is started, it will detect the change and prompt you for the current pass phrase and then for the two new pass phrases.
• Once a database has been encrypted with dual pass phrases, you cannot revert back to a single pass phrase.
• Dual pass phrases require that all BES address spaces that share the same database must be at a maintenance level that supports the PassPhraseCount attribute.
• If multiple BES address spaces are sharing a database protected with a single pass phrase and any one of them is recycled with PassPhraseCount=2 in effect, the database is converted to dual pass phrase protection. The other BES address spaces will detect the change in the pass phrase and query for the new dual pass phrases. Until that query is answered, those BES address spaces will not be able to begin any new encryption work, but any work that has already begun will continue unimpeded.
• You are required to enter the pass phrase or dual pass phrases when:
  • Initializing the BES primary database after installation.
  • Starting up on a disaster recovery system.
  • Upgrading to a different central processing unit.
  • Moving BES to another CPU.
  • Sharing the BES database with another CPU.
  • After changing the value of the Keyhash attribute in the startup options of parmlib.
  • After changing the value of the PassPhraseCount to 2.
  • After issuing the RELOAD=PASSPHRASE command.

  When you enter a lowercase pass phrase on the console and do not enclose it in quotation marks, the pass phrase is folded to uppercase. When you enter the same lowercase pass phrase on the console enclosed in quotation marks, the pass phrase is NOT folded to uppercase. It is considered to be a different pass phrase. The SDSF operator command function folds everything to uppercase, even when you enclose the phrase in quotation marks. CA recommends using uppercase pass phrases to avoid confusion.

• You must provide a new pass phrase that is different from the old one if you need to change it. Use the RELOAD=PASSPHRASE command to change the pass phrase or dual pass phrases.
• Symmetric keys and code books stored in the BES database are protected by the pass phrase.
• CA Tape Encryption re-encrypts the keys stored in the BES database if the pass phrase changes. Changing the pass phrase or dual pass phrases generates a new cryptographic key to securely encrypt the sensitive data in the database.
• You can continue to read tapes that were encrypted with keys based on the old pass phrase.