Figure 6-4 The cryptographic coprocessor CPACF This cryptographic coprocessor, which is known as the CPACF, is not qualified as an HSM;  therefore, it is not suitable for handling algorithms that use secret keys. However, the  coprocessor can be used for cryptographic algorithms that use clear keys or protected keys.  The CPACF works synchronously with the PU, which means that the owning processor is  busy when its coprocessor is busy. This setup provides a fast device for cryptographic  services. CPACF supports pervasive encryption. Simple policy controls allow businesses to enable  encryption to protect data in mission-critical databases without the need to stop the database  or re-create database objects. Pervasive encryption includes z/OS Dataset Encryption, z/OS  Coupling Facility Encryption, z/VM encrypted hypervisor paging, and z/TPF transparent  database encryption, which use performance enhancements in the hardware. The CPACF offers a set of symmetric cryptographic functions that enhances the encryption  and decryption performance of clear key operations. These functions are for SSL, virtual  private network (VPN), and data-storing applications that do not require FIPS 140-2 Level 4  security.  CPACF is designed to facilitate the privacy of cryptographic key material when used for data  encryption through key wrapping implementation. It ensures that key material is not visible to  applications or operating systems during encryption operations. For more information, see  6.4.2, “CPACF protected key” on page 229. The CPACF feature provides hardware acceleration for the following cryptographic services:  GLYPH<SM590000> DES GLYPH<SM590000> Triple-DES GLYPH<SM590000> AES-128 GLYPH<SM590000> AES-192 GLYPH<SM590000> AES-256 (all for clear and protected keys) GLYPH<SM590000> SHA-1 GLYPH<SM590000> SHA-256 (SHA-2 or SHA-3 standard) GLYPH<SM590000> SHA-384 (SHA-2 or SHA-3 standard) GLYPH<SM590000> SHA-512 (SHA-2 or SHA-3 standard) GLYPH<SM590000> SHAKE-128 GLYPH<SM590000> SHAKE-256 GLYPH<SM590000> PRNG GLYPH<SM590000> DRNG GLYPH<SM590000> TRNG Chapter 6. Cryptographic features  227