Crypto Express (CEX) adapters on IBM Z mainframes are specialized hardware cryptographic cards (HSMs – Hardware Security Modules), and their role is to accelerate and secure high-value cryptographic operations.

Here’s a clear breakdown of what they do:

🔐 1. Hardware-based cryptographic processing

Crypto Express adapters offload heavy cryptographic work from the main CPU and perform it in dedicated hardware, including:

• RSA / ECC key generation and signing
• TLS/SSL handshakes (secure web traffic)
• Encryption and decryption of sensitive data
• Digital signature verification

👉 This improves both performance and security

🛡️ 2. Secure key protection (core role)

One of the most important roles is protecting cryptographic keys:

• Keys are stored as secure (wrapped) keys
• The real master key never leaves the hardware
• Even the operating system cannot directly access raw keys

This is why Crypto Express is considered a true HSM (tamper-resistant security boundary).

⚙️ 3. Multiple operational modes

A Crypto Express adapter can be configured for different purposes:

▪️ CCA mode (Coprocessor)

• Used for enterprise secure-key cryptography
• Banking / financial workloads

▪️ EP11 mode (PKCS#11 HSM)

• Standards-based HSM interface
• Used in Linux and cloud security stacks

▪️ Accelerator mode

• High-speed cryptography using clear keys
• Optimized for TLS/SSL and bulk crypto workloads

🧩 4. Secure multi-tenancy (domains)

Each adapter is split into cryptographic domains, which act like isolated mini-HSMs:

• Each domain has its own master key
• Domains are isolated from each other
• Can be assigned to different LPARs or virtual machines

👉 This enables secure sharing of one physical adapter across multiple workloads.

🚀 5. High-security enterprise use cases

Crypto Express adapters are widely used for:

• Banking transaction security
• Payment card encryption (PIN processing)
• Secure TLS termination for high-volume web servers
• Government-grade encryption systems
• Key management for enterprise workloads

🧠 Simple summary

Crypto Express adapters = dedicated hardware security engines that:

• 🔐 Protect encryption keys in hardware
• ⚡ Speed up cryptographic operations
• 🛡️ Provide tamper-resistant security (HSM level)
• 🧩 Enable secure multi-tenant crypto environments
• 🌐 Secure TLS, banking, and enterprise data flows