6.6.1 Logical partition, TKE host, and TKE target 6.6.2 Optional smart card reader If one or more LPARs are configured to use Crypto Express6S or Crypto Express5 S  coprocessors, the TKE workstation can be used to manage DES, AES, ECC, and PKA  master keys. This management can be done for all cryptographic domains of each Crypto  Express coprocessor feature that is assigned to the LPARs that are defined to the TKE  workstation. Each LPAR in the same system that uses a domain that is managed through a TKE  workstation connection is a TKE host or TKE target. An LPAR with a TCP/IP connection to the  TKE is referred to as the  TKE host ; all other partitions are  TKE targets . The cryptographic controls that are set for an LPAR through the SE determine whether the  workstation is a TKE host or a TKE target. An optional smart card reader (FC 0895) can be added to the TKE workstation. One FC 0895  includes two smart card readers, two cables to connect them to the TKE workstation, and 20  smart cards. The reader supports the use of smart cards that contain an embedded  microprocessor and associated memory for data storage. The memory can contain the keys  to be loaded into the Crypto Express features. These readers can be used with smart cards  only that have applets that were loaded from a TKE 8.1 or later. These cards are FIPS  certified. Smart card readers from feature code 0885 or 0891 can be carried forward. Smart cards can  be used on TKE 9.0 with these readers. Access to and use of confidential data on the smart  card are protected by a user-defined PIN. Up to 990 other smart cards can be ordered for  backup. (The extra smart card feature code is FC 0892.) When one feature code is ordered,  10 smart cards are included. The order increment is 1 - 99 (10 - 990 blank smart cards). If smart cards with applets that are not supported by the new smart card reader are reused,  new smart cards on TKE 8.1 or later must be created and the content from the old smart  cards to the new smart cards must be copied. The new smart cards can be created and  copied on a TKE 8.1 system. If the copies are done on TKE 9.0, the source smart card must  be placed in an older smart card reader from feature code 0885 or 0891. A new smart card for the Trusted Key Entry (TKE) allows stronger Elliptic Curve Cryptography  (ECC) levels. More TKE Smart Cards (FC 0900, packs of 10, FIPS certified blanks) require  TKE 9.1 LIC. Note:  Several options for ordering the TKE with or without ordering Keyboard, Mouse, and  Display are available. Ask your IBM Representative for more information about which  option is the best option for you. The new TKE 9.0 LIC (FC 0879) is originally shipped with a new z14 server. As of December,  2018, a new level of TKE LIC, 9.1 (FC 0880) is available and shipped with any new z14  server. If a new TKE is purchased, the following versions are available: 6.6.3 TKE hardware support and migration information GLYPH<SM590000> TKE 9.1 tower workstation (FC 0086) GLYPH<SM590000> TKE 9.1 rack-mounted workstation (FC 0085) Chapter 6. Cryptographic features  203