Press PF5 and use the Settings menu to select the length of use ID and password input area.  Place the cursor in the position you want the password input field to start and use PF4 to  access the Input menu. Pressing PF4 again fills the password input area with the characters  for password input. Press PF11 to display the results. RACF provides the following algorithms for authenticating passwords and password phrases: The masking algorithm is the original algorithm that is provided with RACF. The RACF DES  algorithm provides a higher level of security than the masking algorithm and is identified in the  Federal Information Processing Standard 46-1 of the Computer Systems Laboratory in  Gaithersburg, Maryland, of the National Institute of Standards and Technology of the United  States Government.  DES is accepted as a national and international standard. The KDFAES algorithm provides  the highest level of security, and is resistant to offline attacks. When installing RACF on your  system, the DES algorithm is the default algorithm. RACF also supports an installation-defined method that is implemented that uses the  ICHDEX01 exit. For more information about ICHDEX01, see “RACF Installation Exits”, in  RACF Security Server System Programmer’s Guide , SC24-6312. To display the current enabled algorithms, use the  RACF SETROPTS LIST  command.  Example 5-11 show an excerpt from the command output. In general, encryption programs are a two-way process: encryption and decryption. Encryption  processes use the data and an encryption key to create the encrypted form of the  data. Decryption  is the reverse operation, and uses the encryption key and the encrypted form of  the data to re-create the original data. When configured to do so, RACF uses the encryption algorithms to encrypt the password and  store it on the database. Because RACF does not store the password that is used as the  encryption key, until now, the original data cannot be reconstructed. That is, meaning that the  password that is encrypted and stored in the RACF database cannot be decrypted. With this  one-way process, RACF provides a high level of security. Example 5-11 Password excerpt from RACF SETROPTS LIST command PASSWORD PROCESSING OPTIONS: THE ACTIVE PASSWORD ENCRYPTION ALGORITHM IS LEGACY PASSWORD CHANGE INTERVAL IS 30 DAYS. PASSWORD MINIMUM CHANGE INTERVAL IS 0 DAYS. MIXED CASE PASSWORD SUPPORT IS NOT IN EFFECT SPECIAL CHARACTERS ARE NOT ALLOWED. NO PASSWORD HISTORY BEING MAINTAINED. USERIDS NOT BEING AUTOMATICALLY REVOKED. NO PASSWORD EXPIRATION WARNING MESSAGES WILL BE ISSUED. NO INSTALLATION PASSWORD SYNTAX RULES ARE PRESENT.  RACF user passwords encryption GLYPH<SM590000> Masking GLYPH<SM590000> Data Encryption Standard (DES) algorithm GLYPH<SM590000> Key Derivation Function with AES256 (KDFAES) algorithm for passwords Chapter 5. Security policy management on IBM z/VM  121