ICSF will exploit the performance of the CP Assist for Cryptographic Functions using encrypted AES and DES keys stored in the CKDS. Symmetric Key Encipher and Symmetric Key Decipher callable services will accept the label of a encrypted key as the key identifier. For more information about encryption using protected-key CPACF, see z/OS Cryptographic Services ICSF Overview.