I will preface my next comment by saying .. I haven't looked at the licensing ..
Not that I am advocating anything illegal... but can EKM be treated like BTAM and just pull forward the jar? I suppose it will break at some point, but you could always use cavaj to pull it apart and put it back together with whatever needed to be fixed. Just a thought. TKLM does bring some things to the table that EKM does not have (other than a DB2 requirement). I am sure that I know of at least 2 people that will not be sorry to see EKM go (since the support for EKM was rolled into the JAVA support instead of a separate product). But once people did go thru the work to get EKM running.. there seemed little reason to change what was working. Rob Schramm On Mon, May 2, 2011 at 9:35 AM, Knutson, Sam <sknut...@geico.com> wrote: > It has a cost which I understand is comprised of value units for the > processors on which it operates and the amount of tape and DASD which are > encrypted. > Pricing encryption enablement by storage footprint is even worse than > processor capacity given the explosive data growth we see. > The one good thing that can be said is that ISKLM appears to be much less > complex than TKLM and may be easier to implement. > > IBM Security Key Lifecycle Manager for z/OS V1.1 manages encryption keys > for storage, simplifying deployment and maintaining availability to > data at rest > > http://www.ibm.com/common/ssi/rep_ca/4/897/ENUS211-104/ENUS211-104.PDF > > > EKM is free. The slow withdrawal of EKM has been somewhat stealthy. > > IBM seems to be pushing customers to migrate to ISKLM/TKLM even though I > have yet to see a > Statement Of Direction only this recent announcement that EKM was to be > removed from Java. > > "IBM 31-bit SDK for z/OS, Java Technology Edition Version 6 Release 0 > Modification 1 does not contain the Encryption Key Manager application > (EKM JAR, the jzosekm.jar and sample JCL) in this z/OS Java SDK. Note that > the EKM JAR and related material remain included in IBM 31-bit SDK for > z/OS, Java > Technology Edition Version 6 Release 0 Modification 0." > > from IBM United States Software Announcement > 211-003, dated March 15, 2011. IBM 31-bit SDK for z/OS, Java Technology > Edition Version 6 Release 0 Modification 1 lets application > developers use Java on IBM z/OS. > > ISKLM/TKLM has more function than EKM but it seem unreasonable to remove > the EKM jar files from Java while it is still supported and not SOD or EOS > has been announced. > > I don't think IBM has done enough to communicate to customers that EKM > would be removed from the current best performing Java distribution. > Replacing what has been a base feature on the platform included with z/OS > Java at no charge with a charged product is not well received here. > > I am a little frustrated with the lack of clear communication and the way > this continues to be handled. > > There are competitive options which if forced to purchase a product may be > worth consideration. > > http://www.ca.com/us/products/detail/CA-Encryption-Key-Manager.aspx > > If you don't need full disk encryption on DS8800 you can continue to use > EKM and provided with Java 6.0.0 which is what we are doing with our z/OS > 1.12 order. > > I cannot just make an unbudgeted purchase of ISKLM because they quietly > removed the .jar files from Java 6.0.1.so we won't use Java 6.0.1. > > > Best Regards, > > Sam Knutson, GEICO > System z Team Leader > mailto:sknut...@geico.com > (office) 301.986.3574 > (cell) 301.996.1318 > > "Think big, act bold, start simple, grow fast..." > > > -----Original Message----- > From: IBM Mainframe Discussion List [mailto:IBM-MAIN@bama.ua.edu] On > Behalf Of Mark Jacobs > Sent: Friday, April 29, 2011 7:02 AM > To: IBM-MAIN@bama.ua.edu > Subject: Re: ISKLM as a replacement for EKM > > Our IBM sales rep's told us that ISKLM is priced per tape drive that has > the encryption feature enabled. It would make more sense to me to just > bundle the license to utilize any encryption key manager product into the > price of the optional encryption feature and be done with it. > > Mark Jacobs > > On 04/29/11 05:55, Jousma, David wrote: > > I think it is free. This is the -lite version of TKLM that does not > > require WAS or a DB2 backend. > > > > And JAVA V6 (not 6.0.1) is still orderable in ShopZ, but I don't know > > for how long. V6 still has EKM code in it. > > > > _________________________________________________________________ > > Dave Jousma > > Assistant Vice President, Mainframe Services david.jou...@53.com > > 1830 East Paris, Grand Rapids, MI 49546 MD RSCB1G p 616.653.8429 f > > 616.653.8497 > > > > -----Original Message----- > > From: IBM Mainframe Discussion List [mailto:IBM-MAIN@bama.ua.edu] On > > Behalf Of Lizette Koehler > > Sent: Thursday, April 28, 2011 7:39 PM > > To: IBM-MAIN@bama.ua.edu > > Subject: Re: ISKLM as a replacement for EKM > > > > > >> I concur, looks the same. Just going through conversion now. As an > >> aside, if you order JAVA 6.0.1, the EKM code has been removed.... > >> > >> > >> > > So I guess I need to start making plans to replace EKM. I had thought > > that IBM was providing TLKM for EMK users at no cost. From this > > discussion, I guess that is not the case. > > > > Let me know how your upgrade goes. I will start looking at the life > > expectancy of EKM for my shop. > > > > Lizette > > > ==================== > This email/fax message is for the sole use of the intended > recipient(s) and may contain confidential and privileged information. > Any unauthorized review, use, disclosure or distribution of this > email/fax is prohibited. If you are not the intended recipient, please > destroy all paper and electronic copies of the original message. > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO > Search the archives at http://bama.ua.edu/archives/ibm-main.html > -- Rob Schramm Senior Systems Engineer w: 513.305.6224 ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
