With z14 and carried on to z15, CPACF is enhanced to support pervasive encryption to  provide faster encryption and decryption than previous servers. For every Processor Unit that  is defined as a CP or an IFL, the following benefits are realized: The z13 CPACF provides (supported by z15 and z14 also) the following features:  CPACF must be explicitly enabled by using a no-charge enablement feature (FC 3863). This  requirement excludes the SHAs, which are enabled by default with each server. The enhancements to CPACF are exclusive to the IBM Z servers and are supported by z/OS,  z/VM, z/VSE, z/TPF, and Linux on Z. Crypto-Express7S represents the newest generation of cryptographic features. Cryptographic  performance improvements with new Crypto-Express7S, which is available with two features,  with one (FC 0899) or two (FC 0898) cryptographic co-processors that allow more data to be  securely transferred across the internet. Crypto-Express7S is designed to complement the  cryptographic capabilities of the CPACF. It is an optional feature of the z15 server generation. The Crypto-Express7S feature is designed to provide granularity for increased flexibility with  one or two PCIe adapters per feature. Although installed in the PCIe+ I/O drawer,  Crypto-Express7S features do not perform I/O operations. That is, no data is moved between  the CPC and any externally attached devices. For availability reasons, a minimum of two  features is required. z15 servers allow sharing of a cryptographic coprocessor across 85 domains (the maximum  number of LPARs on the system for z15 is 85). Crypto-Express7S provides higher density of the PCIe cryptographic features with enhanced  PCIe Cryptographic Coprocessor (IBM 4769) and carries forward the functionality of the  Crypto-Express6S, described in the following paragraph. Crypto-Express6S (FC #0893) introduced with z14 server generation can be carried forward  to z15. For availability reasons, a minimum of two features is required. Crypto-Express6S Crypto-Express7S GLYPH<SM590000> Reduced overhead on short data (hashing and encryption) GLYPH<SM590000> Up to 4x throughput for AES compared to z13 GLYPH<SM590000> Special instructions for elliptic curve cryptography (ECC)/RSA GLYPH<SM590000> New hashing algorithms (for example, SHA-3) GLYPH<SM590000> Support for authenticated encryption (combined encryption and hashing; for example,  AES-GCM) GLYPH<SM590000> True random number generator (for example, for session keys) GLYPH<SM590000> For data privacy and confidentially: DES, Triple Data Encryption Standard (TDES), and  AES for 128-bit, 192-bit, and 256-bit keys. GLYPH<SM590000> For data integrity: Secure Hash Algorithm-1 (SHA-1) 160-bit, and SHA-2 for 224-, 256-,  384-, and 512-bit support. SHA-1 and SHA-2 are included as enabled on all z14s and do  not require the no-charge enablement feature. GLYPH<SM590000> For key generation: Pseudo Random Number Generation (PRNG), Random Number  Generation Long (RNGL) (1 - 8192 bytes), and Random Number Generation Long (RNG)  with up to 4096-bit key RSA support for message authentication. Chapter 1. Introduction  29