CEX6S performance
IBM has introduced Version 3 of its PCIe Cryptographic Coprocessor family, called the PCIeCC3 on IBM Z® mainframes (z14® only), as crypto feature Crypto Express6S (CEX6S), feature code (FC) 0893.
The CEX6S provides over 2x performance in most cryptographic algorithms over the CEX5S. The following charts show the examples of operations per second for the IBM CEX6S, CEX5S, and CEX4S for various modes and cryptographic algorithms. All of these examples are on IBM Z systems. Full performance graphs for the IBM CEX6S are in IBM CEX6S Performance Data, Linux on Z (625 KB) and full performance results are available in IBM z14 Performance of Cryptographic Operations (275 KB).
CCA Coprocessor Mode – for secure key encrypted transactions
| CEX6S | CEX5S | CEX4S | |
|---|---|---|---|
| Operation | 8 Concurrent Jobs | 8 Concurrent Jobs | 5 Concurrent Jobs |
| (ops/sec) | (ops/sec) | (ops/sec) | |
| AES-CBC 128 bit (1KB) | > 12K | > 11K | > 2.7K |
| AES-CBC 256 bit (4KB) | > 12K | > 9.9K | > 6.0K |
| PKD-CRT 1024 | > 10K | > 5K | > 2.2K |
| PKD-CRT 2048 | > 9K | > 3.5K | ~920 |
| PKD-CRT 4096 | > 1.3K | > 680 | ~83 |
| Key Gen RSA CRT 1024 bit | > 80 | ||
| Key Gen RSA CRT 2048 bit | > 21 | ||
| Key Gen RSA CRT 4096 bit | > 1.8 | ||
| Key Gen ECC-BP 192 | > 5K | ||
| DSG-CRT 1024 bit | > 10K | > 5.3K | > 2.2K |
| DSG-CRT 2048 bit | > 8.8K | > 3.8K | ~930 |
| DSG-CRT 4096 bit | > 1.3K | ~690 | ~97 |
| DES Key Gen | > 10K | > 5K | > 1.8K |
| DES Clear PIN Gen Alternate | > 14K | > 7K | > 2.2K |
| DES Clear PIN Gen | > 15K | > 10K | > 2.5K |
| Encrypted PIN Translate, DES IPINENC Key / DES OPINENC key | > 15K | > 7.5K | > 2.5K |
| Encrypted PIN Translate, 2 UKPT enabled KEY GENKY keys | > 8.7K | > 2.3K | ~940 |
| Encrypted PIN Verify, UKPT enabled KEY GENKY + DES PINVER keys | > 10K | > 3.2K | > 1.2K |
EP11 Coprocessor Mode – for PKCS #11 secure key operations
| Header 1 | CEX6S | CEX5S |
|---|---|---|
| Operation | 8 Concurrent Jobs | 8 Concurrent Jobs |
| (ops/sec) | (ops/sec) | |
| AES-CBC 128 bit (1KB) | > 8.0K | > 6.0K |
| AES-CBC 256 bit (4KB) | > 5.6K | > 3.9K |
| Private Key Sign 1024 bit | > 5.9K | > 4.9K |
| Private Key Sign 2048 bit | > 4.4K | > 3.8K |
| Private Key Sign 4096 bit | > 1.1K | > 760 |
| Key Gen RSA CRT 1024 bit | > 10 | > 7.7 |
| Key Gen RSA CRT 2048 bit | > 2.4 | > 1.7 |
| Key Gen RSA CRT 4096 bit | > 0.32 | > 0.24 |
| Key Gen ECC-BP 192 | > 62 | > 50 |
Accelerator Mode – for SSL/TLS acceleration
| CEX6S | CEX5S | CEX4S | |
|---|---|---|---|
| Operation | 8 Concurrent Jobs | 8 Concurrent Jobs | 8 Concurrent Jobs |
| (ops/sec) | (ops/sec) | (ops/sec) | |
| PKD-CRT 1024 | > 50K | > 25K | > 6.2K |
| PKD-CRT 2048 | > 9.8K | > 4.9K | > 900 |
| PKD-CRT 4096 | > 1.3K | > 680 |
Please contact Crypto if you have any questions about performance of the IBM Crypto Express (CEX) cryptographic coprocessors.
Follow us
Follow us