## 4.7 Cryptographic functions 

Cryptographic functions are provided by the CP Assist for Cryptographic Function (CPACF) and the PCI Express cryptographic adapters. z15 servers support the Crypto Express6S feature. 

## 4.7.1 CPACF functions (FC 3863) 

## 4.7.2 Crypto Express7S feature (FC 0898 and FC 0899) 

FC 3863$^{11}$ is required to enable CPACF functions. 

The Crypto Express7S represents the newest generation of the Peripheral Component Interconnect Express (PCIe) cryptographic coprocessors, which are an optional feature that is available on the z15. These coprocessors are Hardware Security Modules (HSMs) that provide high-security cryptographic processing as required by banking and other industries. 

This feature provides a secure programming and hardware environment wherein crypto processes are performed. Each cryptographic coprocessor includes general-purpose processors, non-volatile storage, and specialized cryptographic electronics, which are all contained within a tamper-sensing and tamper-responsive enclosure that eliminates all keys and sensitive data on any attempt to tamper with the device. The security features of the HSM are designed to meet the requirements of FIPS 140-2, Level 4, which is the highest security level defined. 

The Crypto Express7S two port includes two PCIe adapters; the Crypto Express7S one port includes one PCIe adapter per feature. For availability reasons, a minimum of two features is required for the one port feature. Up to eight Crypto Express7S two port features are supported. The maximum number of the one-port features is 16. The Crypto Express7S feature occupies one I/O slot in a PCIe+ I/O drawer. 

Each adapter can be configured as a Secure IBM CCA coprocessor, Secure IBM Enterprise PKCS #11 (EP11) coprocessor, or accelerator. 

Crypto Express7S provides domain support for up to 85 logical partitions. 

The accelerator function is designed for maximum-speed Secure Sockets Layer and Transport Layer Security (SSL/TLS) acceleration, rather than for specialized financial applications for secure, long-term storage of keys or secrets. The Crypto Express7S can also be configured as one of the following configurations: 

GLYPH<SM590000> The Secure IBM CCA coprocessor includes secure key functions with emphasis on the specialized functions that are required for banking and payment card systems. It is optionally programmable to add custom functions and algorithms by using User Defined Extensions (UDX). 

A new mode, called Payment Card Industry (PCI) PIN Transaction Security (PTS) Hardware Security Module (HSM) (PCI-HSM), is available exclusively for Crypto Express6S in CCA mode. PCI-HSM mode simplifies compliance with PCI requirements for hardware security modules. 

