If the TKE workstation is chosen to operate the Crypto Express5S features in a z14, TKE  workstation with the TKE 9.x LIC is required. For more information, see 6.6, “TKE  workstation” on page 232. Important:  Products that include any of the cryptographic feature codes contain  cryptographic functions that are subject to special export licensing requirements by the  United States Department of Commerce. It is your responsibility to understand and adhere  to these regulations when you are moving, selling, or transferring these products. To access and use the cryptographic hardware devices that are provided by z14 servers, the  application must use an application programming interface (API) that is provided by the  operating system. In z/OS, the Integrated Cryptographic Service Facility (ICSF) provides the  APIs and is managing the access to the cryptographic devices, as shown in Figure 6-3. ICSF is a software component of z/OS. ICSF works with the hardware cryptographic features  and the Security Server (IBM Resource Access Control Facility (IBM RACFfi) element) to  provide secure, high-speed cryptographic services in the z/OS environment. ICSF provides  the APIs by which applications request the cryptographic services, and from the CPACF and  the Crypto Express6S feature.  ICSF transparently routes application requests for cryptographic services to one of the  integrated cryptographic engines (CPACF or a Crypto Express6S card), depending on  performance or requested cryptographic function. ICSF is also the means by which the  secure Crypto Express6S features are loaded with master key values, which allows the  hardware features to be used by applications. The cryptographic hardware that is installed in  z14 servers determines the cryptographic features and services that are available to the  applications. Figure 6-3 z13 cryptographic support in z/OS Chapter 6. Cryptographic features  215