Jump to content

IBM 4767

From Alfawiki
IBM 4767 PCIe Cryptographic Coprocessor
Company typeHardware security module
IndustryComputer hardware, Cryptography
PredecessorIBM 4765
ProductsCryptographic coprocessor PCIe card
OwnerIBM

The IBM 4767 PCIe Cryptographic Coprocessor is a hardware security module (HSM) that incorporates a secure cryptoprocessor on a tamper-resistant, programmable PCIe card. This device combines dedicated cryptographic circuitry, a microprocessor, RAM, and a random number generator within an environment designed to detect and respond to tampering, thereby safeguarding sensitive key data inside its secure perimeter.

This coprocessor has achieved FIPS PUB 140-2 Level 4 validation—the highest level of certification available for commercial cryptographic hardware—and is comprehensively described in its official documentation.

IBM provides two main cryptographic system solutions:

  • The PKCS#11 implementation offers robust security for applications that utilize this widely adopted API standard.
  • The IBM Common Cryptographic Architecture (CCA) caters to the financial sector’s needs, enabling distributed key management and supporting customizable cryptographic operations.

Additionally, development toolkits are offered to facilitate the creation of tailored applications.

Common use cases include processing financial PINs, managing transactions between banks and clearinghouses, handling EMV chip card interactions, and performing general cryptographic tasks involving symmetric keys, hashing algorithms, and public key cryptography.

Keys used during operation—whether symmetric or RSA private keys—are generated internally within the coprocessor and encrypted under a master key before being stored in keystore files or application memory. Any coprocessor sharing the same master key can access these protected keys. Hardware features such as elliptic curve cryptography (ECC) and format preserving encryption (FPE) are integrated to enhance cryptographic performance.

Supported systems

The IBM 4767 is compatible with selected IBM Z, IBM Power Systems, and x86 servers running either Linux or Microsoft Windows operating systems.

  • IBM Z: Crypto Express5S (CEX5S) - feature code 0890
  • IBM Power Systems: feature codes EJ32 and EJ33
  • x86: Machine type-model 4767-002

History

As of April 2016, the IBM 4767 succeeded the now-discontinued IBM 4765 and continues to be supported on the aforementioned platforms. Its successor, the IBM 4768, was introduced on IBM Z as the Crypto Express6S (CEX6S), identified by feature code 0893.

External links

Key cryptographic standards relevant to this device include:

Retrieved from "https://www.alfawiki.org/index.php?title=IBM_4767&oldid=27983"