0900 New TKE smart cards This will allow the TKE to support zones with EC 521 key strength (EC 521 strength for  Logon Keys, Authority Signature Keys, and EP11 signature keys). 0892 More TKE smart cards When one feature code is ordered, 10 smart cards are included. The order increment  is 1 - 99 (990 blank smart cards). Feature  code Description A TKE includes support for the AES encryption algorithm with 256-bit master keys and key  management functions to load or generate master keys to the cryptographic coprocessor. If the TKE workstation is chosen to operate the Crypto Express5S adapter in a z14 ZR1, TKE  workstation with the TKE 9.x LIC is required. For more information, see 6.6, “TKE  workstation” on page 200. Important:  Products that include any of the cryptographic feature codes contain  cryptographic functions that are subject to special export licensing requirements by the  United States Department of Commerce. It is your responsibility to understand and adhere  to these regulations when you are moving, selling, or transferring these products. To access and use the cryptographic hardware devices that are provided by z14 ZR1, the  application must use an application programming interface (API) that is provided by the  operating system. In z/OS, the Integrated Cryptographic Service Facility (ICSF) provides the  APIs and is managing the access to the cryptographic devices, as shown in Figure 6-3. Crypto z Systems Base z14 ZR1 CPACF (clear key/protected Key) LPAR  Hypervisor HW/SW Software APPLICATION APPLICATION ICSF LPAR z Software Crypto (clear key) Crypto Express5S LPAR x LPAR y z/OS TKE Trusted Key Entry (secure key) HSM Crypto (secure key & clear key ) Figure 6-3 z14 ZR1 cryptographic support in z/OS Chapter 6. Cryptographic features  181