LU11480 and AESENC(NONE)

Products

• Top Secret

Issue/Introduction

LU11480 contains instructions to initialize a new security file with either AESENCRYPT128E (for AES 128 enhanced encryption) or AES256ENCRYPT (for AES 256 encryption).

 We recommend using AES 256 encryption.

Seems that is mandatory to initialize a new security file if the current setup of TSS is using AESENC(NONE)  (3DES encryption).

Is this really mandatory?

Environment

Z/OS 

Top Secret 16.0

Cause

                                    

Resolution

Yes. It is possible to continue working with AESENC(NONE) after applying LU11480.

Nothing will stop working or misbehave.

However, that said, Broadcom strongly recommends that you take the necessary steps to upgrade to AESENC(128E) or better AESENC(256) as soon as possible.

LU11480 was published to solve a vulnerability in systems running with 3DES and AES128 encryption options.

if you do not take any action to convert to AES128E or AES256 you are accepting to run with a vulnerability in your systems.

 

Additional Information

There is more information regarding the vulnerability and the resolution in the published Security Advisory:

 

Top Secret for z/OS 16.0 Vulnerability in 3DES and AES128 encryption options