The RSA encryption and decryption functions support key lengths of 512 - 4,096 bits in the  Modulus-Exponent (ME) and Chinese Remainder Theorem (CRT) formats. Each cryptographic coprocessor has 85 physical sets of registers or queue registers, which  corresponds to the maximum number of LPARs that are running on a z15, which is also 85.  Each of these sets belongs to the following domains: The installation of CP Assist for Cryptographic Functions (CPACF) DES/TDES enablement  (FC 3863) is required to use the Crypto Express7S feature. Each Crypto Express7S FC 0898 includes two PCI-X adapters; FC 0899 includes one PCI-X  adapter. The adapters are available in the following configurations: During the feature installation, the PCI-X adapter is configured by default as the CCA  coprocessor. The configuration of the Crypto Express7S adapter as EP11coprocessor requires a TKE  tower workstation (FC 0088) or a TKE rack-mounted workstation (FC 0087) with TKE 9.2  (FC 0881) LIC. The same requirement applies to CCA mode for a full PCI-compliant  environment. The Crypto Express7S feature does not use CHPIDs from the channel subsystem pool.  However, the Crypto Express7S feature requires one slot in a PCIe I/O drawer, and one  PCHID for each PCIe cryptographic adapter. For enabling an LPAR to use a Crypto Express7S adapter, the following cryptographic  resources in the image profile must be defined for each partition: This task is accomplished by using the Customize/Delete Activation Profile task, which is in  the Operational Customization Group, from the HMC or from the SE. Modify the  cryptographic initial definition from the Crypto option in the image profile, as shown in  Figure 6-7 on page 243.  Important:  After this definition is modified, any change to the image profile requires a  DEACTIVATE and ACTIVATE of the logical partition for the change to take effect.  Therefore, this cryptographic definition is disruptive to a running system. 242  IBM z15 (8561) Technical Guide 6.5.5 Managing Crypto Express7S GLYPH<SM590000> A cryptographic domain index, in the range of 0 - 84 for z15, is allocated to a logical  partition in its image profile. The same domain must also be allocated to the ICSF instance  that is running in the logical partition that uses the Options data set. GLYPH<SM590000> Each ICSF instance accesses only the Master Keys or queue registers that correspond to  the domain number that is specified in the logical partition image profile at the SE and in  its Options data set. Each ICSF instance sees a logical cryptographic coprocessor that  consists of the physical cryptographic engine and the unique set of registers (the domain)  that is allocated to this logical partition. GLYPH<SM590000> IBM Enterprise Common Cryptographic Architecture (CCA) Coprocessor (CEX7C) GLYPH<SM590000> IBM Enterprise Public Key Cryptography Standards #11 (PKCS) Coprocessor (CEX7P) GLYPH<SM590000> IBM Crypto Express7S Accelerator (CEX7A) GLYPH<SM590000> Usage domain index GLYPH<SM590000> Control domain index GLYPH<SM590000> PCI Cryptographic Coprocessor Candidate List GLYPH<SM590000> PCI Cryptographic Coprocessor Online List