IV73306: SIGNATURE FAILURES WITH CLEAR KEY OPERATIONS WHEN ICSF MASTER KE Y CHANGES

APAR status

• Closed as program error.

Error description

• Error Message: ICSF returnCode 8 reasonCode 48 "One or more keys
  has a master key verification pattern that is not valid."
  .
  Stack Trace:
  com.ibm.crypto.hdwrCCA.provider.JCECCARuntimeException: Hardware
  error from call CSNDDSG returnCode 8 reasonCode 48
   at
  com.ibm.crypto.hdwrCCA.provider.Crypto.a(Crypto.java:86)
   at
  com.ibm.crypto.hdwrCCA.provider.Crypto.a(Crypto.java:71)
   at
  com.ibm.crypto.hdwrCCA.provider.DatawithRSA.engineSign(DatawithR
  SA.java:106)
   at
  java.security.Signature$Delegate.engineSign(Signature.java:1191)
   at java.security.Signature.sign(Signature.java:560)
  .
  

Local fix

Problem summary

• Changing the ICSF master key will cause signature operations
  with clear RSA keys to fail with a master key verification
  error.
  

Problem conclusion

• The code has been modified so these signature operations no
  longer fail due to master key changes.
  .
  This APAR will be fixed in the following Java Releases:
   7 SR9 FP 10 (7.0.9.10)
   7 R1 SR3 FP10 (7.1.3.10)
   8 SR1 FP10 (8.0.1.10)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
   https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R260 PSY

     UP

• R270 PSY

     UP