The TKE contains a combination of hardware and software. A mouse, keyboard, flat panel  display, PCIe adapter, and a writable USB media to install the TKE Licensed Internal Code  (LIC) are included with the system unit. The TKE workstation requires an IBM 4768 crypto  adapter. A TKE workstation is part of a customized solution for the use of the Integrated Cryptographic  Service Facility for z/OS (ICSF for z/OS) or Linux for IBM Z. This program provides a basic  key management system for the cryptographic keys of a z15 system that has Crypto Express  features installed. The TKE provides a secure, remote, and flexible method of providing Master Key Part Entry,  and to remotely manage PCIe cryptographic coprocessors. The cryptographic functions on  the TKE run by one PCIe cryptographic coprocessor. The TKE workstation communicates  with the IBM Z system through a TCP/IP connection. The TKE workstation is available with  Ethernet LAN connectivity only. Up to 10 TKE workstations can be ordered.  TKE FCs 0087 and 0088 can be used to control any supported Crypto Express feature  supported on z15. They also can be used to control the Crypto Express6S, Crypto Express5S  on z14, Crypto Express5S on z13 and z13s systems, and the Crypto adapters on older, still  supported systems. The TKE 9.2 LIC (FC 0881) features the following enhancements over the described  functions of LIC 9.1 and 9.0: The following enhancements were introduced with TKE 9.1 LIC (FC 0880): GLYPH<SM590000> TKE 9.2 LIC is enhanced with functions to support the management of the Crypto  Express7S 4769 host crypto module. GLYPH<SM590000> TKE 9.2 allow Host Transaction Programs to run over a TLS connection for z/OS LPARs.  The TKE is checking whether TLS is configured on the Host Transaction Program port and  automatically uses TLS when communicating with the host. GLYPH<SM590000> The TKE 9.2. supports AES Operational Key parts to be tagged as PCI-compliant. With  CCA 6.3, support for marking some AES operational key parts as being PCI-compliant is  introduced. The TKE is mandatory to support the PCI-compliant environment for  CCA-mode. GLYPH<SM590000> A new Stronger encryption is used when negotiating the session key to an EP11 Domain.  When loading key parts into an EP11 host domain, a session key is derived by the smart  card and the target domain. The BLUE TKE smart cards (00RY790) includes 521-bit EC  capability. The 521-bit EC strength is used during the EP11 session key derivation  process. For CCA-mode, this stronger encryption was made available with TKE 9.1 LIC. GLYPH<SM590000> TKE 9.2 supports 32 character user IDs when the TKE Host Transaction Program is on a  LINUX system. GLYPH<SM590000> TKE 9.1 License Internal Code enhancements for support EC521 strength TKE and  Migration zones. An EC521 Migration zone is required if you want to use the migration  wizard to collect and apply PCI-compliant domain information.  GLYPH<SM590000> TKE 9.1 also has a new family of wizards that makes it easy to create EC521 zones on all  of its smart cards. This feature simplifies the process of deploying a TKE for the first time  or moving data from a weaker TKE zone to a new EC521 zone. GLYPH<SM590000> A new smart card for the TKE allows stronger Elliptic Curve Cryptography (ECC) levels.  Other TKE Smart Cards (FC 0900, packs of 10, FIPS certified blanks) require TKE 9.1  LIC. TKE 9.2 can handle a combination of AT-TLS configured hosts with those hosts that are  not TLS capable. Chapter 6. Cryptographic features  245