z/VM encrypted hypervisor paging (encrypted paging support) z/TPF transparent database encryption Pervasive encryption for Linux on Z Protection of data at-rest Protection of data in-flight 7.4.7 Special-purpose Features and Functions With the PTF for APAR VM65993 (planned to be available December 15, 2017), z/VM V6.4  will provide support for encrypted paging in support of the z14 pervasive encryption  philosophy of encrypting all data in flight and at rest. Ciphering will occur as data moves  between active memory and a paging volume owned by z/VM.  Included in this support is the ability to dynamically control whether a running z/VM system is  encrypting this data. This support will protect guest paging data from administrators or users  with access to volumes. Enabled with AES encryption, z/VM Encrypted Paging includes low  overhead by using CPACF. The supported operating systems are listed in Table 7-10 on page 259. Shipped in August 2016, z/TPF at-rest Data Encryption provides following features and  benefits: Pervasive encryption for Linux on Z combines the full power of Linux with z14 capabilities by  using the support of the following features: By using the integration of industry-unique hardware accelerated CPACF encryption into the  standard Linux components, users can achieve optimized encryption transparently to prevent  raw key material from being visible to OS and applications. Because of the potential costs and overheads, most of the organizations avoid the use of  host-based network encryption today. By using enhanced CPACF and SIMD on z14, TLS and  IPSec can use hardware performance gains while benefitting from transparent enablement.  Reduced cost of encryption enables broad use of network encryption. This section describes the zEnterprise Data Compression Express. GLYPH<SM590000> Automatic encryption of at-rest data by using AES CBC (128 or 256). GLYPH<SM590000> No application changes required. GLYPH<SM590000> Database level encryption by using highly efficient CPACF. GLYPH<SM590000> Inclusion of data on disk and cached in memory. GLYPH<SM590000> Ability to include data integrity checking (optionally by using SHA-256) to detect accidental  or malicious data corruption. GLYPH<SM590000> Tools to migrate a database from un-encrypted to encrypted state or change the  encryption key/algorithm for a specific DB while transactions are flowing (no database  downtime). GLYPH<SM590000> Kernel Crypto: z14 CPACF GLYPH<SM590000> LUKS dm-crypt Protected-Key CPACF GLYPH<SM590000> Libica and openssl: z14 CPACF and acceleration of RSA handshakes by using SIMD GLYPH<SM590000> Secure Service Container: High security virtual appliance deployment infrastructure Chapter 7. Operating system support  305