Definiciones operacionales

The Magic Box Company sends some sensitive data to the fictitious Hyena Corp. An RSA key protects the data key. Alexander Harris of Hyena Corp uses

RACDCERT to generate the RSA key pair. Alexander has a z/OS V1.7 with HCR7720 system running on a z990 with two CEX2Cs. Anne Summers of the Magic Box a z/OS V1.7 system with ICSF FMID HCR7720 running on a z9 platform with two CEX2C cards.

All the preceding RACF RACDCERT commands were issued in batch mode with the JCL shown in Example 8-3.

Example 8-3 JCL used to issue RACDCERT commands //STEP1 EXEC PGM=IKJEFT01

//SYSTSPRT DD SYSOUT=* //SYSTSIN DD *

<put RACDCERT commands here> /*

//RESTORE EXEC PGM=ADRDSSU //SYSPRINT DD SYSOUT=* //ENCFILE DD DISP=SHR,DSN=GWEN.WATCHERS.DATA.DUMP02 //DECFILE DD DISP=(NEW,CATLG), // UNIT=SYSDA, // SPACE=(CYL,(50,5),RLSE) //SYSIN DD *

RESTORE DATASET (INCLUDE(**)) - INDD(ENCFILE) - OUTDDNAME(DECFILE) - CATALOG -

RSA(WATCHERS.MAGICBOX.1024.KEY) /*

Tip: A common practice is to issue the RACDCERT commands in batch mode

rather than in the TSO foreground interactive mode. The commands are easier to type in. The output from the command can also be viewed easily with your favorite JOBLOG viewing tool such as SDSF or EJES.

The scenario proceeds as follows:

1. Alexander creates an RSA key pair using RACF. He gets it signed by an external trusted certificate authority (CA):

a. Alexander creates a self-signed certificate with a 2048-bit key using the RACDCERT command, as shown in Figure 8-14. The certificate is called RSA2048 Magic Box to Hyena. The RSA key label in the PKDS is RSA.2048.MAGICBOX.2.HYENA.

The certificate labels are case-sensitive and can include blanks. The ICSF key labels are in uppercase and cannot contain any blanks.

Figure 8-14 RACDCERT command to create self-signed certificate

b. Alexander creates a certificate request to send to an external CA. The request is in a data set called ALEX.CERT.REQ.ARM. The RACDCERT command Alexander uses is shown in Figure 8-15.

Figure 8-15 RACDCERT command to generate a certificate request

c. Alexander sends the certificate request in the data set

ALEX.CERT.REQ.ARM to the CA. The certificate request is in Base 64-encoded text. Alexander sends the certificate request in an e-mail to the CA as a text attachment. The CA validates the certificate and signs it. The CA returns it to Alexander. Alexander transfers the certificate back to the host into the data set ALEX.SIGNED.CER.

RACDCERT ID(ALEX) - GENCERT - SUBJECTSDN(CN('Magic Box to Hyena') - O('Hyena') - L('Sunnydale') - SP('CA') - C('US')) - WITHLABEL('RSA2048 Magic Box to Hyena') - SIZE(2048) - PCICC(RSA.2048.MAGICBOX.2.HYENA)

RACDCERT ID(ALEX) -

GENREQ (LABEL('RSA2048 Magic Box to Hyena')) - DSN('ALEX.CERT.REQ.ARM')

Chapter 8. The DFSMSdss Encryption feature 121

d. Alexander replaces the self-signed certificate with the certificate signed by the CA. The RACDCERT command Alexander uses is shown in

Figure 8-16.

Figure 8-16 RACDCERT command to import signed certificate into RACF

e. Alexander lists the certificate with the RACDCERT command, as shown in Figure 8-17, to make sure that the certificate is good.

Figure 8-17 RACDCERT command to list the certificate

2. Alexander exports the public key to a data set to send to Anne. Figure 8-18 shows the RACDCERT command. The certificate data set is in PKCS#7 format encoded in Base 64. The data set is called

ALEX.MAGIC.PUBLIC.CER.

Figure 8-18 RACDCERT command to export the public key into a certificate

3. Anne receives the certificate as an e-mail attachment from Alexander. She uses FTP to upload the certificate to the host. Because the certificate is Base 64 encoded, she uploads the certificate in ASCII mode.

RACDCERT ID(ALEX) -

ADD('ALEX.SIGNED.CER') -

WITHLABEL('RSA2048 Magic Box to Hyena')

Important: We assume here that the certificate authority’s certificate

has been already installed in the RACF database as a CERTAUTH certificate. RACF then verifies the newly added certificate for the validity of the issuer’s digital signature. If the certificate authority’s certificate is not already installed in the RACF database, you must manually put the added certificate in the TRUST status in the RACF database.

RACDCERT ID(ALEX) -

LIST (LABEL('RSA2048 Magic Box to Hyena'))

RACDCERT ID(ALEX) EXPORT -

EXPORT (LABEL('RSA2048 Magic Box to Hyena')) - DSN('ALEX.MAGIC.PUBLIC.CER') -

4. Anne imports Alexander’s certificate as a SITE certificate. The RACDCERT command is shown in Figure 8-19. The certificate data set is called

ANNE.HYENA.PUBLIC.CER. The certificate label is Hyena Corp 2048 Public Key. The key label in the PKDS is HYENA.2048.PUB.KEY.

Figure 8-19 RACDCERT command to import the public key into the PKDS

5. Anne encrypts the data with the JCL shown in Figure 8-20. Anne sends the data over to Alexander.

Figure 8-20 JCL to encrypt using the HYENA.2048.PUB.KEY RSA key RACDCERT SITE ADD - ('ANNE.HYENA.PUBLIC.CER') -

WITHLABEL('Hyena Corp 2048 Public Key') - PCICC('HYENA.2048.PUB.KEY')

Important: We do not recommend that you associate the certificate with a

user ID for a specific individual. From a logical standpoint, a certificate and the public key used by Encryption Facility is not a personal certificate. Making it a SITE certificate makes more sense. From a practical

standpoint, if the certificate is associated with an individual and the person leaves the company, you have to be careful in the method you use to delete the person's resources. If you delete the user ID, the certificate will remain in place. If IRRRID00 is run to remove all traces of the user ID from RACF, the certificate will be deleted. Certificate deletion will attempt to remove the corresponding RSA keys from the PKDS.

//DUMP EXEC PGM=ADRDSSU //SYSPRINT DD SYSOUT=* //ENCFILE DD DSN=ANNE.HYENA.DATA.DUMP01, // DISP=(NEW,CATLG), // SPACE=(CYL,(40,5),RLSE), // UNIT=SYSDA //SYSIN DD *

DUMP DATASET (INCLUDE(ANNE.HYENA.**)) - OUTDDNAME(ENCFILE) -

RSA(HYENA.2048.PUB.KEY) - ENCRYPT(ENCTDES) -

HWCOMPRESS /*

Chapter 8. The DFSMSdss Encryption feature 123

6. Alexander receives the data from Anne. Alexander decrypts the data with the JCL shown in Figure 8-21.

Figure 8-21 JCL to decrypt using RSA.2048.MAGICBOX.2.HYENA private key //RESTORE EXEC PGM=ADRDSSU

//SYSPRINT DD SYSOUT=* //ENCFILE DD DISP=SHR,DSN=ALEX.HYENA.DATA.DUMP01 //DECFILE DD DISP=(NEW,CATLG), // UNIT=SYSDA, // SPACE=(CYL,(50,5),RLSE) //SYSIN DD *

RESTORE DATASET (INCLUDE(**)) - INDD(ENCFILE) - OUTDDNAME(DECFILE) - CATALOG -

RSA(RSA.2048.HYENA.2.MAGICBOX) /*

© Copyright IBM Corp. 2007. All rights reserved. 125