IBM 4765
| Company type | Hardware security module |
|---|---|
| Industry | Computer hardware, Cryptography |
| Predecessor | IBM 4764 |
| Founded | May 2011 |
| Fate | Phased out |
| Successor | IBM 4767 |
| Products | Hardware security module (HSM) |
The IBM 4765 PCIe Cryptographic Coprocessor is a hardware security module (HSM) that incorporates a secure cryptoprocessor on a tamper-resistant, programmable PCIe card. This device combines dedicated cryptographic circuitry, a microprocessor, memory components, and a random number generator within a tamper-evident environment, providing a robust platform for cryptography and data processing tasks.
Certified at FIPS PUB 140-2 Level 4—the highest commercial cryptographic device standard—the IBM 4765 supports two primary cryptographic frameworks:
- The PKCS#11 interface delivers a high-assurance solution compatible with this widely adopted API standard.
- The IBM Common Cryptographic Architecture (CCA) offers specialized functions tailored to the financial sector, distributed key management capabilities, and support for customized cryptographic operations.
Development toolkits are provided to facilitate the creation of tailored applications.
Typical applications include financial PIN verification, bank-to-clearing-house transaction processing, EMV chip card interactions, and general cryptographic operations involving symmetric key algorithms, hashing functions, and public-key cryptography.
Keys used during operation—whether symmetric or RSA private keys—are generated internally within the coprocessor and encrypted under a master key. This design enables any coprocessor sharing the same master key to access these keys securely.
Supported systems
IBM offers support for the 4765 on IBM Z, IBM POWER platforms, and IBM-certified x86 servers running either Linux or Microsoft Windows.
- IBM Z: Crypto Express4S (CEX4S) / Crypto Express3C (CEX3C) with feature code 0865
- IBM POWER: feature codes EJ27, EJ28, and EJ29
- x86: Machine type-model 4765-001
History
The IBM 4765 was introduced in May 2011 as the successor to the discontinued IBM 4764. It has since been phased out across all supported platforms. Its replacement, the IBM 4767, is available on these IBM server families:
- IBM Z as Crypto Express5S with feature code 0890
- IBM POWER systems under feature codes EJ32 and EJ33
- x86 servers identified as model 4767-002
External links
Key cryptographic standards include:
- ISO 13491 - Secure Cryptographic Devices: https://www.iso.org/standard/61137.html
- ISO 9564 - PIN security: https://www.iso.org/standard/68669.html
- ANSI X9.24 Part 1: Key Management using Symmetric Techniques: https://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.24-1-2017
- ANSI X9.24 Part 2: Key Management using Asymmetric Techniques: https://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.24-2-2016
- FIPS 140-2: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf