4.7 Cryptographic functions 4.7.1 CPACF functions (FC 3863) 4.7.2 Crypto Express7S feature (FC 0898 and FC 0899) Cryptographic functions are provided by the CP Assist for Cryptographic Function (CPACF)  and the PCI Express cryptographic adapters. z15 servers support the Crypto Express6S  feature. FC 3863$^{11}$ is required to enable CPACF functions. The Crypto Express7S represents the newest generation of the Peripheral Component  Interconnect Express (PCIe) cryptographic coprocessors, which are an optional feature that  is available on the z15. These coprocessors are Hardware Security Modules (HSMs) that  provide high-security cryptographic processing as required by banking and other industries.  This feature provides a secure programming and hardware environment wherein crypto  processes are performed. Each cryptographic coprocessor includes general-purpose  processors, non-volatile storage, and specialized cryptographic electronics, which are all  contained within a tamper-sensing and tamper-responsive enclosure that eliminates all keys  and sensitive data on any attempt to tamper with the device. The security features of the HSM  are designed to meet the requirements of FIPS 140-2, Level 4, which is the highest security  level defined. The Crypto Express7S two port includes two PCIe adapters; the Crypto Express7S one port  includes one PCIe adapter per feature. For availability reasons, a minimum of two features is  required for the one port feature. Up to eight Crypto Express7S two port features are  supported. The maximum number of the one-port features is 16. The Crypto Express7S  feature occupies one I/O slot in a PCIe+ I/O drawer. Each adapter can be configured as a Secure IBM CCA coprocessor, Secure IBM Enterprise  PKCS #11 (EP11) coprocessor, or accelerator. Crypto Express7S provides domain support for up to 85 logical partitions. The accelerator function is designed for maximum-speed Secure Sockets Layer and  Transport Layer Security (SSL/TLS) acceleration, rather than for specialized financial  applications for secure, long-term storage of keys or secrets. The Crypto Express7S can also  be configured as one of the following configurations: A new mode, called Payment Card Industry (PCI) PIN Transaction Security (PTS)  Hardware Security Module (HSM) (PCI-HSM), is available exclusively for Crypto  Express6S in CCA mode. PCI-HSM mode simplifies compliance with PCI requirements for  hardware security modules. GLYPH<SM590000> The Secure IBM CCA coprocessor includes secure key functions with emphasis on the  specialized functions that are required for banking and payment card systems. It is  optionally programmable to add custom functions and algorithms by using User Defined  Extensions (UDX). 11 Subject to export regulations. Chapter 4. Central processor complex I/O structure  201