Commands › CRYPTKEY Command: Define a Name for an Encryption Key

CRYPTKEY Command: Define a Name for an Encryption Key

The CRYPTKEY command defines and securely stores an encryption key that is used for communication by z/OS Agent with scheduling managers.

Type: Authorized command

Authority: You must have UPDATE authority to the PASSWORD security profile to delete or update an encryption key without supplying the old encryption key.

Applicability:

• CA Workload Automation DE
• CA Workload Automation AE, Release 11.3 or higher

This command has the following format:

CRYPTKEY{DEFINE KEYNAME(name) KEY(key) type}
        {DELETE KEYNAME(name) KEY(key) type}
        {LIST [KEYNAME(name)][KEY(key)] type}
        {UPDATE KEYNAME(name) KEY(key) OLDKEY(okey) type}

DEFINE

Defines a new encryption key.

DELETE

Deletes an encryption key and removes the connection to the scheduling manager.

LIST

Displays a list of encryption keys.

UPDATE

Updates an encryption key.

KEYNAME(name)

Defines a name for the encryption key. KEYNAME is required for DEFINE, UPDATE, and DELETE and is optional for LIST.

Limits: The maximum length is 16 characters.

KEY(key)

Specifies the encryption key. KEY is required for DEFINE, DELETE, and UPDATE and ignored with LIST.

Limits: The limit depends on the type of key. For details, see the type operand.

OLDKEY(okey)

Specifies the previous encryption key that is related to the name in KEYNAME. OLDKEY is required for UPDATE when you do not have UPDATE access to the host security CRYPTKEY profile. OLDKEY is ignored with DEFINE, DELETE, and LIST.

type

Specifies the type of encryption key. The values are as follows:

• DES—Maximum encryption key of 16 hexadecimal characters.
• BLOWFISH—Maximum encryption key of 64 hexadecimal characters.
• AES—Encryption key of exactly 32 hexadecimal characters (AES128 standard, 128 bits).

Important! If you enter more than the maximum number of characters for a DES or BLOWFISH key, the key is truncated. For AES, you get an error message for not specifying the exact key length.

Notes:

• This command encrypts an encryption key and stores it in a data set. The encryption standard that is used to encrypt the key is not related to the encryption standard used for the key itself (specified in the type operand).
• If you delete or change an encryption key, specify the old encryption key. If you have UPDATE authority to the PASSWORD security profile, you do not need to specify the old encryption key.
• If you specify an incorrect key in OLDKEY, the request fails. In this case, the request fails even if you have UPDATE authority to the PASSWORD security profile.

Example 1: DES Encryption

This example shows type DES encryption.

CRYPTKEY DEFINE KEYNAME(agntr6) KEY(X'0102030405060708') DES

Example 2: Blowfish Encryption

This example shows type BLOWFISH encryption.

CRYPTKEY DEFINE KEYNAME(agblf) KEY(X'12345678901234567890') BLOWFISH

Example 3: AES Encryption

This example shows type AES encryption.

CRYPTKEY DEFINE KEYNAME(aeskey) KEY(X'’000102030405060708090A0B0C0D0E0F') AES