Before EP11, the ICSF PKCS #11 implementation supported only clear keys. In EP11, keys  can now be generated and securely wrapped under the EP11 Master Key. The secure keys  never leave the secure coprocessor boundary decrypted.  The secure IBM Enterprise PKCS #11 (EP11) coprocessor runs the following tasks: The function extension capability through UDX is not available to the EP11. When defined in EP11 mode, the TKE workstation is required to manage the Crypto  Express6S feature. z/OS V2.2 and V2.3 require ICSF Web Deliverable WD18 (HCR77D0) to support the  following new features: A Crypto Express7S adapter that is running in accelerator mode supports only RSA clear key  and SSL Acceleration. A request is processed fully in hardware. The Crypto Express  accelerator is a coprocessor that is reconfigured by the installation process so that it uses  only a subset of the coprocessor functions at a higher speed. Reconfiguration is disruptive to  coprocessor and accelerator operations. The coprocessor or accelerator must be deactivated  before you begin the reconfiguration. FIPS 140-2 certification is not relevant to the accelerator because it operates with clear keys  only. The function extension capability through UDX is not available to the accelerator. The functions that remain available when the Crypto Express6S feature is configured as an  accelerator are used for the acceleration of modular arithmetic operations. That is, the RSA  cryptographic operations are used with the SSL/TLS protocol. The following operations are  accelerated: 6.5.4 Crypto Express7S as an accelerator GLYPH<SM590000> PKA Decrypt (CSNDPKD) with PKCS-1.2 formatting GLYPH<SM590000> PKA Encrypt (CSNDPKE) with zero-pad formatting GLYPH<SM590000> Digital Signature Verify GLYPH<SM590000> Encrypt and decrypt (AES, DES, TDES, and RSA) GLYPH<SM590000> Sign and verify (DSA, RSA, and ECDSA) GLYPH<SM590000> Generate keys and key pairs (DES, AES, DSA, ECC, and RSA) GLYPH<SM590000> HMAC (SHA1, SHA2 or SHA3 [SHA224, SHA256, SHA384, and SHA512]) GLYPH<SM590000> Digest (SHA1, SHS2 or SHA3 [SHA224, SHA256, SHA384, and SHA512]) GLYPH<SM590000> Wrap and unwrap keys GLYPH<SM590000> Random number generation GLYPH<SM590000> Get mechanism list and information GLYPH<SM590000> Attribute values GLYPH<SM590000> Key Agreement (Diffie-Hellman) GLYPH<SM590000> EP11 Stage 4: – New elliptic curve algorithms for PKCS #11 signature, key derivation operations: GLYPH<129> Ed448 elliptic curve GLYPH<129> EC25519 elliptic curve – EP11 Concurrent Patch Apply: Allows service to be applied to the EP11 coprocessor  dynamically without taking the crypto adapter offline (already available for CCA  coprocessors). – eIDAS compliance: eIDAS: Cross-border EU regulation for portable recognition of  electronic identification. Chapter 6. Cryptographic features  241