Defining System Options in Parmlib › Sample Parmlib Members › Symmetric Key Options › Cryptographic Algorithms Supported

Cryptographic Algorithms Supported

CA Tape Encryption provides software implementations of the AES128, AES192, and AES256 algorithms. These algorithms are provided to insure that you can encrypt and decrypt tape files at a disaster recovery site where crypto-processors may not be available. The performance of these software-based algorithms is slower than the same algorithms implemented in hardware (CPACF) or in the IBM ICSF software implementations. For this reason, CA recommends selecting an algorithm supported by your cryptographic hardware. This gives you significant performance improvement.

CA Tape Encryption provides software implementations of the MD5, SHA-1, and SHA-256 hashing algorithms. These algorithms are provided so that you can run CA Tape Encryption at recovery sites where a hardware implementation of the algorithm may not be available.

The DES64, 3DES128, and 3DES192 algorithms are available in hardware on all systems with a CCF or CPACF processor installed. CA Tape Encryption does not have a software implementation of the DES64, 3DES128, and 3DES192 algorithms. Ensure that the algorithm is provided by CCF, CPACF, or ICSF at your disaster recovery site.

Note: Software versions of the AES and hashing algorithms are available on all systems.

The following list identifies when a hardware implementation of an algorithm is available:

IBM z800 or z900 with CCF

The algorithms supported in hardware are the:

• DES64, 3DES128, and 3DES192 symmetric algorithms.
• SHA-1 hashing algorithm.
• RSA asymmetric encryption algorithm.

IBM z800 or z900 without CCF

There are no algorithms supported in hardware.

IBM z890 or z990 with CPACF

The algorithms supported in hardware are the:

• DES64, 3DES128, and 3DES192 symmetric algorithms.
• SHA-1 hashing algorithm.
• RSA asymmetric encryption algorithm. Hardware support is provided by a PCI-based coprocessor. If the hardware is not present, the encryption is performed by software with low CP overhead.

IBM z890 or z990 without CPACF

There are no algorithms supported in hardware.

IBM z9 with CPACF

The algorithms supported in hardware are the:

• DES64, 3DES128, 3DES192, and AES128 symmetric algorithms.
• SHA-1 and SHA-256 hashing algorithms.
• RSA asymmetric encryption algorithm. Hardware support is provided by a PCI-based coprocessor. If the hardware is not present, the encryption is performed by software with low CP overhead.

IBM z10 or z11 with CPACF

The algorithms supported in hardware are the:

• DES64, 3DES128, 3DES192, AES128, AES192 and AES256 symmetric algorithms.
• SHA-1 and SHA-256 hashing algorithms.
• RSA asymmetric encryption algorithm. Hardware support is provided by a PCI-based coprocessor. If the hardware is not present, the encryption is performed by software with low CP overhead.

Note: The RSA encryption algorithm is employed only when encrypting symmetric keys for B2B tapes.