ICSF - Integrated Cryptographic Service Facility

Enhanced Definition

ICSF (Integrated Cryptographic Service Facility) is a z/OS component that provides a secure, high-performance cryptographic services platform, leveraging specialized cryptographic hardware on IBM Z mainframes. It enables z/OS applications and system components to perform various cryptographic operations, including encryption, decryption, hashing, digital signatures, and secure key management.

Key Characteristics

- Hardware-Accelerated: ICSF offloads cryptographic processing to dedicated hardware (e.g., Crypto Express adapters, CPACF - Central Processor Assist for Cryptographic Functions), significantly improving performance and security.
- Comprehensive Cryptographic Services: Supports a wide range of cryptographic algorithms and functions, including symmetric (AES, DES), asymmetric (RSA, ECC), hashing (SHA-x), MAC generation, digital signatures, and random number generation.
- Secure Key Management: Provides secure storage and management of cryptographic keys through specialized datasets: the CKDS (Cryptographic Key Dataset) for symmetric keys, the PKDS (Public Key Dataset) for asymmetric keys, and the TKDS (Token Key Dataset) for PKA tokens.
- Callable Services API: Offers a rich set of callable services that applications (written in COBOL, Assembler, C/C++, Java) can invoke to integrate cryptographic functions directly into their logic.
- Tight z/OS Integration: Seamlessly integrates with core z/OS services and components, including RACF for resource authorization, AT-TLS for network security, DB2 for data encryption, and various middleware products like CICS and MQ.
- FIPS 140-2 Compliance: Designed to meet stringent government security standards for cryptographic modules, ensuring a high level of trust and regulatory compliance.

Use Cases

- Data at Rest Encryption: Encrypting sensitive data stored in DB2 tables, VSAM files, or sequential datasets using application-level encryption or z/OS data set encryption features.
- Data in Transit Encryption: Securing network communications for applications (e.g., CICS, MQ, FTP, TN3270) via AT-TLS (Application Transparent Transport Layer Security), which uses ICSF for TLS/SSL cryptographic operations.
- Digital Signatures and Verification: Authenticating the origin and ensuring the integrity of data, transactions, or code (e.g., for secure software distribution or financial transactions).
- Secure Key Generation and Storage: Generating and securely storing cryptographic keys (e.g., master keys, data-encrypting keys) within the CKDS or PKDS under the protection of hardware security modules.
- Password Hashing and Authentication: Enhancing the security of user authentication systems by using ICSF to generate strong cryptographic hashes of passwords.

Related Concepts

ICSF is fundamental to the security posture of z/OS. It acts as the software interface to the physical cryptographic coprocessors (e.g., Crypto Express adapters, CPACF) on the IBM Z server, making their capabilities accessible to the operating system and applications. RACF (Resource Access Control Facility) is used to protect access to ICSF callable services, cryptographic keys, and the CKDS/PKDS/TKDS datasets. AT-TLS heavily relies on ICSF to perform the underlying cryptographic operations for securing network connections, transparently to applications. Databases like DB2 for z/OS and middleware like CICS and MQ can either directly call ICSF services for application-level encryption or leverage AT-TLS for secure communication, both ultimately depending on ICSF.

Best Practices:

Secure Master Key Management: Establish rigorous procedures for loading, backing up, and rotating ICSF master keys, as these keys protect all other cryptographic keys.
Strict RACF Authorization: Implement granular RACF profiles to control access to ICSF callable services, key labels, and the CKDS/PKDS/TKDS datasets, following the principle of least privilege.
Adequate Hardware Configuration: Ensure sufficient cryptographic hardware (e.g., Crypto Express adapters) is configured, online, and properly partitioned to meet performance, availability, and workload demands.
Regular Key Rotation: Implement a policy for periodic rotation of data-encrypting keys and public/private key pairs to mitigate the risk of long-term key compromise.
Monitoring and Auditing: Continuously monitor ICSF activity, resource utilization, and security events (e.g., failed cryptographic operations, key access attempts) using SMF records and system logs for anomaly detection and compliance.