SAF may be invoked to verify the caller is authorized to use this callable service, the key label, or internal secure key tokens that are stored in the CKDS or PKDS.

The Symmetric Algorithm Decipher - secure AES keys access control point controls the function of this service.

Table 134. Symmetric Algorithm Decipher required hardware

Server	Required cryptographic hardware	Restrictions
IBM zSeries 900		This service is not supported.
IBM zSeries 990 IBM zSeries 890		This service is not supported.
IBM System z9 EC IBM System z9 BC	Crypto Express2 Coprocessor	Secure AES key support requires the Nov. 2008 or later licensed internal code (LIC)