Pervasive encryption in IBM Z means that data is encrypted “everywhere by default” (data at rest, in flight within the system, and often within subsystems like databases and storage paths). It is designed so encryption is hardware-accelerated and largely transparent to applications, but it still has measurable effects on I/O throughput and latency.

The impact depends heavily on where encryption is applied and how much hardware offload is used.

1. Core idea: encryption becomes part of the I/O path

In a traditional I/O flow:

Application → OS → I/O subsystem → storage

With pervasive encryption:

Application → OS → encryption/decryption step (CPU + crypto engines) → I/O subsystem → storage

So encryption is inserted into the critical I/O path, but IBM Z minimizes cost using hardware acceleration.

2. Key enabler: Crypto Express + CPACF hardware

IBM Z avoids major performance loss using:

A. CPACF (Central Processor Assist for Cryptographic Functions)

• Built into every core
• Handles bulk encryption (AES, SHA, etc.)
• Very high throughput, low latency

B. Crypto Express adapters (optional)

• Offload specialized or high-security operations
• Secure key handling (PKCS#11, secure key storage)

👉 Result: encryption is hardware-accelerated, not software-heavy

3. Where throughput impact occurs

Even with hardware acceleration, encryption affects:

A. CPU cycles per I/O

Each I/O now includes:

• encrypt (write path)
• decrypt (read path)

👉 Adds extra CPU work per byte

B. Memory bandwidth pressure

Data must be:

• read from memory
• encrypted/decrypted
• written back or sent to I/O

👉 Increases memory traffic

C. I/O path latency

Small additional delay from:

• encryption stage
• key lookup
• crypto engine queueing

D. Buffer handling overhead

Data often:

• cannot be directly passed through buffers unchanged
• requires staging buffers for crypto operations

4. Impact on throughput (practical view)

A. With full hardware offload (typical IBM Z case)

• Throughput impact: low (often single-digit %)
• CPU overhead: minimal
• I/O pipelines remain highly parallel

👉 Most workloads see negligible slowdown

B. Crypto-heavy workloads

(e.g., full-disk encryption + database encryption + TLS)

• Higher CPU utilization
• Potential bottlenecks if CPACF saturated
• Increased latency under extreme load

C. Small I/O vs large I/O

5. Why IBM Z still maintains high throughput

IBM Z design reduces impact through:

A. Parallel crypto pipelines

• multiple cryptographic execution units per core
• high concurrency

B. In-stream encryption

• encryption happens inline with data movement
• reduces extra memory copies

C. Cache-aware optimization

• avoids redundant encryption of cached data
• leverages CF/cache structure awareness

D. Key management efficiency

• fast hardware key lookup
• reduced software overhead in key handling

6. Interaction with CF and sysplex

Pervasive encryption also affects sysplex components:

A. CF structures

• some CF traffic may be encrypted in transit
• adds minimal overhead to CF link operations

B. DB2 data sharing

• encrypted pages still participate in CF cache coherency
• decryption happens at system boundary, not inside CF

C. XCF messaging

• control messages may be encrypted depending on configuration

7. Net effect on system throughput

Positive side

• No need for application-level encryption (reduces duplicate work)
• Hardware acceleration preserves scalability
• Security overhead is predictable and controlled

Negative side

• Extra CPU cycles per byte
• Slight increase in I/O latency
• Potential bottlenecks in crypto-intensive workloads

8. Key trade-off

Pervasive encryption shifts the system balance:

9. Simple mental model

Think of pervasive encryption as:

Adding a high-speed cryptographic filter into every I/O pipeline, where IBM Z uses hardware engines so efficiently that it behaves almost like a built-in stage of the processor rather than a separate processing step.

Key takeaway

Pervasive encryption affects I/O throughput by:

• Adding encryption/decryption steps into every I/O path
• Increasing CPU and memory bandwidth usage
• Slightly increasing I/O latency
• But minimizing impact through deep hardware acceleration (CPACF + Crypto Express)

👉 In IBM Z, the real-world throughput impact is usually small because encryption is designed as a first-class hardware function, not a software overhead.