Cryptographic hardware features

This topic describes the cryptographic hardware features available. Information on adding and removing cryptographic coprocessors can be found in z/OS Cryptographic Services ICSF Administrator's Guide.

Crypto Express5 adapter (CEX5C, CEX5P, or CEX5A)

The Crypto Express5 adapter is an asynchronous cryptographic coprocessor or accelerator. The adapter contains one cryptographic engine that can be configured as a coprocessor (CEX5C for CCA and CEX5P for PKCS #11) or as an accelerator (CEX5A). It is available on IBM z13 and IBM z13s.

Crypto Express4 adapter (CEX4C, CEX4P, or CEX4A)

The Crypto Express4 adapter is an asynchronous cryptographic coprocessor or accelerator. The adapter may be configured as a CCA coprocessor (CEX4C), an Enterprise PKCS #11 coprocessor (CEX4P), or as an accelerator (CEX4A). It is available on IBM zEnterprise EC12 and IBM zEnterprise BC12.

Crypto Express3 adapter (CEX3C or CEX3A)

The Crypto Express3 adapter is an asynchronous cryptographic coprocessor or accelerator. The adapter contains two cryptographic engines that can be independently configured as a coprocessor (CEX3C) or as an accelerator (CEX3A). It is available on the IBM System z10 Enterprise Class, IBM System z10 Business Class, IBM zEnterprise 196, IBM zEnterprise 114, IBM zEnterprise EC12, and the IBM zEnterprise BC12.

Crypto Express2 adapter (CEX2C or CEX2A)

The Crypto Express2 adapter is an asynchronous cryptographic coprocessor or accelerator. The adapter contains two cryptographic engines that can be independently configured as a coprocessor (CEX2C) or as an accelerator (CEX2A). It is available on the IBM System z9 Enterprise Class, IBM System z9 Business Class, IBM System z10 Enterprise Class, and IBM System z10 Business Class.

CP Assist for Cryptographic Functions (CPACF)

CPACF is a set of cryptographic instructions available on all CPs. Use of the CPACF instructions provides improved performance. The SHA-1 algorithm is always available. Additionally, SHA-224 and SHA-256 algorithms are available on the z9 EC / z9 BC and newer systems. Additionally, SHA-384 and SHA-512 algorithms are available on z10 EC / z10 BC and newer systems.

CP Assist for Cryptographic Functions (CPACF) DES/TDES Enablement, feature 3863, provides for clear key DES and TDES instructions. On the z9 EC / z9 BC and later systems, this feature includes clear key AES for 128-bit keys. On z10 EC / z10 BC and later systems, this feature also includes clear key AES for 192-bit and 256-bit keys.