Managing Crypto Express4 Features on an IBM zEnterprise BC12 and EC12

The Crypto Express4 feature can be configured as a coprocessor for secure key operation or as an accelerator for clear key RSA operations. If configured as a coprocessor, it may be configured for CCA or PKCS #11. When configured as the latter, it is known as an Enterprise PKCS #11 coprocessor.

The Crypto Express4 feature’s configuration may be switched from a CCA coprocessor to an accelerator and back without undergoing zeroization. If master keys have been loaded into the registers on the Crypto Express4 feature, the master keys will not be zeroized when the configuration is changed.
Note: This is not true for the Enterprise PKCS #11 coprocessor configuration. A switch from CCA or accelerator to PKCS #11 will result in the zeroization of the CCA master keys (DES, AES, RSA, and ECC) and settings. A switch from PKCS #11 to CCA or accelerator will result in the zeroization of the P11 master key and settings.

The Crypto Express4 is configured from the support element. See Support Element Operations Guide, SC28-6820, for details.

When changing the configuration: