IEC161I 069(00000008,00000C04) - VSAM Pervasive Encryption Open Failure - Datacom/DB

Products

• Datacom
• Datacom/AD
• Datacom/DB
• Top Secret
• ACF2

Issue/Introduction

The following error occurs during a Datacom/DB Multi-User Facility (MUF) initialization or DBUTLTY utility job execution when attempting to access a VSAM Linear Data Set (LDS) configured with IBM Pervasive Encryption (PE):

IEC161I 069(00000008,00000C04)-162

This error indicates a failure during the z/OS OPEN macro processing for an encrypted dataset. The return code 00000008 and reason code 00000C04 are returned by the Integrated Cryptographic Service Facility (ICSF), signaling that the security product (e.g., Top Secret) denied the request to wrap or retrieve the encryption key.

Cause

The root cause for this is missing hardware-wrapping permissions in the External Security Manager (ESM) for the ICSF CSFKEYS class. When the hardware-accelerated Central Processor Assist for Cryptographic Functions (CPACF) is used for dataset encryption, ICSF must be explicitly permitted to wrap and return the key to the hardware. If the security profile protecting the encryption key label does not include the necessary CPACF parameters, ICSF blocks the key retrieval, causing the OPEN failure.

Resolution

To resolve this issue, the security administrator must update the permissions for access to the encryption key label.

1. Identify the encryption key label assigned to the VSAM dataset.
2. In the ESM, grant the necessary SYMCPACFWRAP and SYMCPACFRET permissions for the RACF User, TSS ACID, or the ACF2 UID:
   1. (TSS): TSS PERMIT(<acid>) CSFKEYS(<key.label>) + ACCESS(READ) + SYMCPACFWRAP(YES) + SYMCPACFRET(YES)
   2. (ACF2): $KEY(your.key.label) TYPE(SAF)
         UID(uid_string_for_user) SERVICE(READ) ALLOW
   3. (RACF): RALTER CSFKEYS your.key.label ICSF(SYMCPACFWRAP(YES) SYMCPACFRET(YES))
         PERMIT your.key.label CLASS(CSFKEYS) ID(the_user_ID) ACCESS(READ)
         SETROPTS RACLIST(CSFKEYS) REFRESH
3. Re-run the job (e.g., DBUTLTY or MUF startup) to verify the dataset opens successfully.
4. Ensure these parameters are added to all users or started tasks that require access to this or any other encryption key labels used for Pervasive Encryption (PE).

Additional Information

References:

Contact Us: Contact Broadcom Support (KB 206567) 

Subscribe to Knowledge Articles: https://knowledge.broadcom.com/external/article/275360