IBM 4768
| Company type | Product |
|---|---|
| Industry | Cryptographic hardware, Banking technology |
| Products | Hardware security module (HSM) |
The IBM 4768 PCIe Cryptographic Coprocessor is a hardware security module (HSM) that incorporates a secure cryptoprocessor within a tamper-resistant, programmable PCIe card. This device combines dedicated cryptographic circuitry, a microprocessor, memory, and a random number generator inside an environment that actively responds to tampering attempts, thereby safeguarding sensitive key information within its protected perimeter.
Certified at FIPS PUB 140-2 Level 4—the highest security level available for commercial cryptographic devices—and also holding PCI-HSM certification, the IBM 4768 supports two main cryptographic system implementations:
- The PKCS#11 implementation delivers support for high-assurance applications through this widely adopted industry-standard API.
- The IBM Common Cryptographic Architecture (CCA) is designed primarily for financial institutions, offering comprehensive distributed key management alongside adaptable cryptographic capabilities.
Typical applications encompass financial PIN processing, transactions between banks and clearing houses, EMV chip card functionalities, as well as general cryptographic tasks involving symmetric key operations, hashing processes, and public key algorithms.
All operational keys are generated internally by the coprocessor and encrypted under its master key for secure storage; any coprocessor sharing the same master key can access these encrypted keys. Performance is further optimized by integrating elliptic curve cryptography (ECC) and format-preserving encryption (FPE) techniques.
Support for the 4768 is provided on selected IBM Z mainframe systems under the designation Crypto Express6S (CEX6S), feature code 0893. The 4768/CEX6S plays a critical role in IBM’s pervasive encryption initiative, which focuses on encrypting data comprehensively to strengthen overall security.
In September 2019, IBM introduced the IBM 4769 as the next-generation model succeeding the 4768.
References
External links
Key cryptographic standards relevant to this technology include:
- ISO 13491 - Secure Cryptographic Devices: https://www.iso.org/standard/61137.html
- ISO 9564 - PIN Security: https://www.iso.org/standard/68669.html
- ANSI X9.24 Part 1 - Symmetric Key Management Techniques: https://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.24-1-2017
- ANSI X9.24 Part 2 - Asymmetric Key Management Techniques: https://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.24-2-2016
- FIPS 140-2 Security Requirements: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf
- PCI PIN Transaction Security (PTS) Hardware Security Module (HSM) Modular Security Requirements: https://www.pcisecuritystandards.org/document_library