CEX6S performance

IBM has introduced Version 3 of its PCIe Cryptographic Coprocessor family, called the PCIeCC3 on IBM Z® mainframes (z14® only), as crypto feature Crypto Express6S (CEX6S), feature code (FC) 0893.

The CEX6S provides over 2x performance in most cryptographic algorithms over the CEX5S. The following charts show the examples of operations per second for the IBM CEX6S, CEX5S, and CEX4S for various modes and cryptographic algorithms. All of these examples are on IBM Z systems. Full performance graphs for the IBM CEX6S are in IBM CEX6S Performance Data, Linux on Z (625 KB) and full performance results are available in IBM z14 Performance of Cryptographic Operations (275 KB).

CEX6S performance

CCA Coprocessor Mode – for secure key encrypted transactions

  CEX6S CEX5S CEX4S
Operation 8 Concurrent Jobs 8 Concurrent Jobs 5 Concurrent Jobs
  (ops/sec) (ops/sec) (ops/sec)
AES-CBC 128 bit (1KB) > 12K > 11K > 2.7K
AES-CBC 256 bit (4KB) > 12K > 9.9K > 6.0K
PKD-CRT 1024 > 10K > 5K > 2.2K
PKD-CRT 2048 > 9K > 3.5K ~920
PKD-CRT 4096 > 1.3K > 680 ~83
Key Gen RSA CRT 1024 bit > 80    
Key Gen RSA CRT 2048 bit > 21    
Key Gen RSA CRT 4096 bit > 1.8    
Key Gen ECC-BP 192 > 5K    
DSG-CRT 1024 bit > 10K > 5.3K > 2.2K
DSG-CRT 2048 bit > 8.8K > 3.8K ~930
DSG-CRT 4096 bit > 1.3K ~690 ~97
DES Key Gen > 10K > 5K > 1.8K
DES Clear PIN Gen Alternate > 14K > 7K > 2.2K
DES Clear PIN Gen > 15K > 10K > 2.5K
Encrypted PIN Translate, DES IPINENC Key / DES OPINENC key > 15K > 7.5K > 2.5K
Encrypted PIN Translate, 2 UKPT enabled KEY GENKY keys > 8.7K > 2.3K ~940
Encrypted PIN Verify, UKPT enabled KEY GENKY + DES PINVER keys > 10K > 3.2K > 1.2K

 

EP11 Coprocessor Mode – for PKCS #11 secure key operations

Header 1 CEX6S CEX5S
Operation 8 Concurrent Jobs 8 Concurrent Jobs
  (ops/sec) (ops/sec)
AES-CBC 128 bit (1KB) > 8.0K > 6.0K
AES-CBC 256 bit (4KB) > 5.6K > 3.9K
Private Key Sign 1024 bit > 5.9K > 4.9K
Private Key Sign 2048 bit > 4.4K > 3.8K
Private Key Sign 4096 bit > 1.1K > 760
Key Gen RSA CRT 1024 bit > 10 > 7.7
Key Gen RSA CRT 2048 bit > 2.4 > 1.7
Key Gen RSA CRT 4096 bit > 0.32 > 0.24
Key Gen ECC-BP 192 > 62 > 50

Accelerator Mode – for SSL/TLS acceleration

  CEX6S CEX5S CEX4S
Operation 8 Concurrent Jobs 8 Concurrent Jobs 8 Concurrent Jobs
  (ops/sec) (ops/sec) (ops/sec)
PKD-CRT 1024 > 50K > 25K > 6.2K
PKD-CRT 2048 > 9.8K > 4.9K > 900
PKD-CRT 4096 > 1.3K > 680  

Please contact Crypto if you have any questions about performance of the IBM Crypto Express (CEX) cryptographic coprocessors.