## 4.7 Cryptographic functions 

Cryptographic functions are provided by the CP Assist for Cryptographic Function (CPACF) and the PCI Express cryptographic adapters. z14 ZR1 servers support the Crypto Express6S feature. 

## 4.7.1 CPACF functions (FC 3863) 

## 4.7.2 Crypto Express6S feature (FC 0893) 

FC 3863$^{11}$ is required to enable CPACF functions. 

Crypto Express6S is a new feature on z14 ZR1 servers. On the initial configuration, a minimum of two features are installed. The number of features then increases one at a time up to a maximum of 16 features. 

Each Crypto Express6S feature holds one PCI Express cryptographic adapter. Each adapter can be configured by the installation as a Secure IBM Common Cryptographic Architecture (CCA) coprocessor, as a Secure IBM Enterprise Public Key Cryptography Standards (PKCS) #11 (EP11) coprocessor, or as an accelerator. 

The tamper-resistant hardware security module, which is contained on the Crypto Express6S feature, conforms to the Federal Information Processing Standard (FIPS) 140-2 Level 4 Certification. It supports User Defined Extension (UDX) services to implement cryptographic functions and algorithms (when defined as an IBM CCA coprocessor). 

The following CCA compliance levels are available: 

GLYPH<SM590000> Non-compliant (default) 

GLYPH<SM590000> PCI-HSM 2016 

GLYPH<SM590000> PCI-HSM 2016 (migration, key tokens while migrating to compliant) 

The following EP11 compliance levels are available (Crypto Express6S and Crypto Express5S): 

GLYPH<SM590000> FIPS 2009 (default) 

GLYPH<SM590000> FIPS 2011 

GLYPH<SM590000> BSI 2009 

GLYPH<SM590000> BSI 2011 

Each Crypto Express6S feature occupies one I/O slot in the PCIe I/O drawer, and features no CHPID assigned. However, it includes one PCHID. 

## 4.7.3 Crypto Express5S feature (FC 0890) 

Crypto Express5S was introduced from z13 servers. On the initial configuration, a minimum of two features are installed. The number of features then increases one at a time up to a maximum of 16 features. 

Each Crypto Express5S feature holds one PCI Express cryptographic adapter. Each adapter can be configured by the installation as a Secure IBM CCA coprocessor, as a Secure IBM Enterprise Public Key Cryptography Standards (PKCS) #11 (EP11) coprocessor, or as an accelerator. 

