Before EP11, the ICSF PKCS #11 implementation supported only clear keys. In EP11, keys can now be generated and securely wrapped under the EP11 Master Key. The secure keys never leave the secure coprocessor boundary decrypted. 

The secure IBM Enterprise PKCS #11 (EP11) coprocessor runs the following tasks: 

GLYPH<SM590000> Encrypt and decrypt (AES, DES, TDES, and RSA) 

GLYPH<SM590000> Sign and verify (DSA, RSA, and ECDSA) 

GLYPH<SM590000> Generate keys and key pairs (DES, AES, DSA, ECC, and RSA) 

GLYPH<SM590000> HMAC (SHA1, SHA2 or SHA3 [SHA224, SHA256, SHA384, and SHA512]) 

GLYPH<SM590000> Digest (SHA1, SHS2 or SHA3 [SHA224, SHA256, SHA384, and SHA512]) 

GLYPH<SM590000> Wrap and unwrap keys 

GLYPH<SM590000> Random number generation 

GLYPH<SM590000> Get mechanism list and information 

GLYPH<SM590000> Attribute values 

GLYPH<SM590000> Key Agreement (Diffie-Hellman) 

The function extension capability through UDX is not available to the EP11. 

When defined in EP11 mode, the TKE workstation is required to manage the Crypto Express6S feature. 

z/OS V2.2 and V2.3 require ICSF Web Deliverable WD18 (HCR77D0) to support the following new features: 

GLYPH<SM590000> EP11 Stage 4: 

– New elliptic curve algorithms for PKCS #11 signature, key derivation operations: 

GLYPH<129> Ed448 elliptic curve 

GLYPH<129> EC25519 elliptic curve 

– EP11 Concurrent Patch Apply: Allows service to be applied to the EP11 coprocessor dynamically without taking the crypto adapter offline (already available for CCA coprocessors). 

– eIDAS compliance: eIDAS: Cross-border EU regulation for portable recognition of electronic identification. 

## 6.5.4 Crypto Express7S as an accelerator 

A Crypto Express7S adapter that is running in accelerator mode supports only RSA clear key and SSL Acceleration. A request is processed fully in hardware. The Crypto Express accelerator is a coprocessor that is reconfigured by the installation process so that it uses only a subset of the coprocessor functions at a higher speed. Reconfiguration is disruptive to coprocessor and accelerator operations. The coprocessor or accelerator must be deactivated before you begin the reconfiguration. 

FIPS 140-2 certification is not relevant to the accelerator because it operates with clear keys only. The function extension capability through UDX is not available to the accelerator. 

The functions that remain available when the Crypto Express6S feature is configured as an accelerator are used for the acceleration of modular arithmetic operations. That is, the RSA cryptographic operations are used with the SSL/TLS protocol. The following operations are accelerated: 

GLYPH<SM590000> PKA Decrypt (CSNDPKD) with PKCS-1.2 formatting 

GLYPH<SM590000> PKA Encrypt (CSNDPKE) with zero-pad formatting 

GLYPH<SM590000> Digital Signature Verify 

