The Crypto Express (CEX) adapter in IBM Z is a dedicated hardware cryptographic processor that offloads encryption, decryption, and key-management operations from the general-purpose CPU, allowing cryptographic workloads to run faster, more securely, and more predictably.

Instead of the CPU doing cryptography in software, the work is sent to the adapter, executed in hardware, and returned as results.

1. Core idea: hardware offload model

Crypto Express moves cryptographic work out of the main CPU and into a specialized secure hardware engine designed only for cryptography.

So the flow becomes:

Application → ICSF API → Crypto Express adapter → result returned

2. What tasks it offloads

Crypto Express handles:

A. Asymmetric cryptography

• RSA
• ECC (Elliptic Curve Cryptography)
• Digital signatures
• Certificate operations (PKI, TLS handshakes)

B. Secure key operations

• Key generation
• Key wrapping/unwrapping
• Master key–protected operations
• Secure key storage (non-exportable keys)

C. High-assurance encryption services

• TLS session key handling
• Payment card encryption (PIN processing, EMV)
• HSM-grade operations (PCI compliance workloads)

3. How offloading works (step-by-step)

Step 1: Application request

An application (e.g., DB2, CICS, web server) calls:

• ICSF (Integrated Cryptographic Service Facility)
• or PKCS#11 APIs

Example: “Encrypt data or sign message”

Step 2: ICSF prepares request

ICSF:

• validates permissions
• selects correct key
• packages cryptographic request

Step 3: Request sent to Crypto Express

The request is sent via:

• internal I/O channels (not general CPU execution path)
• secure command interface

Step 4: Hardware execution

Inside the adapter:

• cryptographic engines perform operations
• keys remain inside secure hardware boundary
• no plaintext key exposure to OS or memory

Step 5: Result returned

• encrypted/decrypted data returned to system memory
• or signature generated
• or key wrapped securely

4. Why it improves performance

A. Parallel crypto engines

Crypto Express has dedicated processing units:

• multiple concurrent cryptographic operations
• no contention with CPU cores

B. Offload reduces CPU load

Without offload:

• CPU spends cycles on AES, RSA, hashing

With offload:

• CPU only orchestrates requests

👉 CPU is free for application logic

C. Better scaling under load

As crypto demand increases:

• more requests are queued and handled by adapter
• CPU usage remains stable

D. Predictable latency

Hardware execution ensures:

• consistent timing
• reduced jitter compared to software crypto

5. Security advantages of offloading

A. Isolated execution environment

• cryptographic operations occur inside secure module
• OS cannot inspect internal key state

B. Non-exportable keys

• private keys never leave hardware boundary
• only cryptographic results are exposed

C. Tamper-resistant hardware

• physical and logical protections
• secure boot and firmware validation

6. Relationship with CPACF (important distinction)

IBM Z uses two crypto engines:

👉 CPACF = speed
👉 CEX = security + high-assurance cryptography

7. Interaction with system software

Crypto Express integrates with:

A. ICSF

• controls access
• manages keys
• routes requests

B. z/OS applications

• DB2 encryption
• CICS transactions
• TLS stack (z/OS Communications Server)

C. Security compliance frameworks

• PCI-DSS
• FIPS 140-2/3 HSM requirements

8. Impact on system throughput

Positive effects:

• reduced CPU utilization
• higher transaction throughput under crypto-heavy workloads
• better scalability for secure workloads

Minor overhead:

• request submission latency (very small)
• queueing under extreme load in adapter

9. Simple mental model

Think of Crypto Express as:

A secure cryptographic co-processor that acts like a dedicated “encryption engine server” inside the mainframe, receiving requests from the CPU, executing them in hardware, and returning results without exposing sensitive keys.

Key takeaway

Crypto Express offloads encryption by:

• Receiving cryptographic requests from ICSF or applications
• Executing them entirely in secure hardware engines
• Keeping private keys inside protected boundaries
• Returning only results (ciphertext, signatures, wrapped keys)
• Reducing CPU load while increasing security and scalability