Create Key Store (CRTKEYSTR)

The Create Key Store (CRTKEYSTR) command allows authorized users to create a Key Store for containing Symmetric Keys.

Screen Example:  CRTKEYSTR Command with Sample Values

The following users can utilize this command:

  • QSECOFR user profile (unless excluded in the Key Officer settings)
  • A user profile with *SECADM authority (unless excluded in the Key Officer settings)
  • A Key Officer who has a *YES specified for the "Maintain key stores" authority setting.
  • When Set as default key store (SETDFT) is *YES A Key Officer who has a *YES specified for the "Maintain key policy" authority setting.

The Key Store is created as a Validation List (*VLDL) object on the System i.

This command requires authority to IBM's CRTVLDL (Create Validation List) command.

This command requires authority to IBM's CRTLIB (Create Library) command when CRTLIB (Create Library) is set to *YES.

How to Get There

From the Symmetric Encryption Key Menu, choose option 1.

Options

Key store name (KEYSTR)

Indicate the name and library of the Key Store, which is created as a Validation List (*VLDL) object on the System i.

Create library (CRTLIB)

Indicate to create the key store library if it does not exist.

The possible values are:

*YES
Create the library if it does not exist. If the library already exists, then ignore the parameter.
*NO
This is the Default. Do not attempt to create the library if it does not exist.
MEK id number (MEKID)

Indicate the id number of the Master Encryption Key (MEK) which will be used to encrypt any Symmetric Keys which are added (created) to the Key Store.

The possible values are:

mek-id-number
Indicate a number from 1-8. A *CURRENT version of the MEK must exist.
Description (TEXT)

Indicate the description for the Key Store object.

Public authority (AUT)

Indicate the public authority for the Key Store *VLDL object.

TIP: Specify *EXCLUDE to not allow the public to use the Key Store. Individual users or user groups can then be added later with the EDTOBJAUT command for the Key Store *VLDL object.

The possible values are:

*EXCLUDE
Grants *PUBLIC *EXCLUDE authority for the Key Store *VLDL object.\
*USE
Grants *PUBLIC *USE authority for the Key Store *VLDL object.
*CHANGE
Grants *PUBLIC *CHANGE authority for the Key Store *VLDL object.
*ALL
Grants *PUBLIC *ALL authority for the Key Store *VLDL object.
Set the key store as the default (SETDFT)

Indicate to set the new key store as the default key store in the key policy.

The possible values are:

*YES
Set the new key store as the default in the key policy.
*NO
This is the Default. Do not set the new key store as the default key store in the key policy.
 

 

Related Topics