z15 servers allow sharing of a cryptographic coprocessor across 85 domains (the maximum number of LPARs on the system for z15 is 85). 

The Crypto-Express6S is a state-of-the-art, tamper-sensing, and tamper-responding programmable cryptographic feature that provides a secure cryptographic environment. Each adapter contains a tamper-resistant hardware security module (HSM). The HSM can be configured as a Secure IBM CCA coprocessor, as a Secure IBM Enterprise PKCS #11 (EP11) coprocessor, or as an accelerator. Consider the following points: 

GLYPH<SM590000> A Secure IBM CCA coprocessor is for secure key encrypted transactions that use CCA callable services (default). 

GLYPH<SM590000> A Secure IBM Enterprise PKCS #11 (EP11) coprocessor implements an industry standardized set of services that adhere to the PKCS #11 specification v2.20 and more recent amendments. This new cryptographic coprocessor mode introduced the PKCS #11 secure key function. 

GLYPH<SM590000> An accelerator for public key and private key cryptographic operations is used with Secure Sockets Layer/Transport Layer Security (SSL/TLS) acceleration. 

The Crypto-Express6S is designed to meet the following cryptographic standards, among others: 

GLYPH<SM590000> FIPS 140-2 Level 4 14 

GLYPH<SM590000> Common Criteria EP11 EAL4 

GLYPH<SM590000> ANSI 9.97 

GLYPH<SM590000> Payment Card Industry (PCI) HSM 

GLYPH<SM590000> German Banking Industry Commission (GBIC), (formerly DK, Deutsche Kreditwirtschaft) 

Federal Information Processing Standard (FIPS) 140-2 certification is supported only when Crypto-Express6S is configured as a CCA or an EP11 coprocessor. 

Crypto-Express6S supports several ciphers and standards that are described next. For more information about cryptographic algorithms and standards, see Chapter 6, “Cryptographic features” on page 217. 

## Trusted Key Entry workstation 

The Trusted Key Entry (TKE) feature is an integrated solution that is composed of workstation firmware, hardware, and software to manage cryptographic keys in a secure environment. The TKE is network-connected or isolated, in which case smart cards are used. 

The TKE workstation offers a security-rich solution for basic local and remote key management. It provides authorized personnel with a method for key identification, exchange, separation, update, and backup, and a secure hardware-based key loading mechanism for operational and master keys. TKE also provides secure management of host cryptographic module and host capabilities. 

Support for an optional smart card reader that is attached to the TKE workstation allows the use of smart cards that contain an embedded microprocessor and associated memory for data storage. Access to and the use of confidential data on the smart cards are protected by a user-defined personal identification number (PIN). 

TKE workstation and the most recent TKE 9.2 LIC are optional features on the z15. TKE workstation is offered in two types: TKE Tower (FC 0088) and TKE Rack Mount (FC 0087). 

