SAF may be invoked to verify the caller is authorized to use this callable service, the key label, or internal secure key tokens that are stored in the CKDS or PKDS.

The following table shows the access control points in the ICSF role that control the function of this service.

This table lists the required cryptographic hardware for each server type and describes restrictions for this callable service.

Table 114. Trusted Block Create required hardware

Server	Required cryptographic hardware	Restrictions
IBM zSeries 990 IBM zSeries 890		This callable service is not supported.
IBM zSeries 900		This callable service is not supported.
IBM System z9 EC IBM System z9 BC	Cryptographic Express2 Coprocessor	RSA key support with moduli within the range 2048-bit to 4096-bit requires the Nov. 2007 or later licensed internal code (LIC).