Crypto Hardware Support
The configuration file has a keyword,
UseCryptoHardware, that governs the use of crypto hardware. The available support depends on the processor model and on the devices that are installed. In the table below, CPACF is standard on z890 and z990 machines but is not available on other machines. The CCA column includes the following devices: CCF, PCICC, PCIXCC and CEX2. The Accelerator column includes the PCICA device, PCIXCC and CEX2.
| ||CPACF ||CCA ||Accelerator|
|3DES-CBC ||x ||x |
|SHA1 ||x || |
|RNG || ||x |
|[RSA] || ||[x] ||[x]|
|[DH] || || ||[x]|
|RACF certificate|| ||x |
If any crypto hardware devices are to be used, the machine or the LPAR must be enabled for cryptography.
Note: The current release has no hardware support for RSA or DH.
FIPS mode is enabled when the IBM crypto hardware is used. FIPS mode is currently not available in SSH Tectia Server for IBM z/OS when the software crypto library is used.
Thus, if the
UseCryptoHardware keyword defines algorithms for hardware acceleration, the FIPS mode is automatically enabled for the defined algorithms and cryptographic operations are performed according to the rules of the FIPS 140-2 certification standard. In all other configurations, FIPS mode is disabled.