IBM 4769
| Industry | Information technology, Computer hardware, Cryptography |
|---|---|
| Founded | June 16, 1911 in Endicott, New York, United States |
| Headquarters | Armonk, New York , United States |
| Products | IBM 4769 PCIe Cryptographic Coprocessor, Crypto Express7S (CEX7S) |
| Website | www |
The IBM 4769 PCIe Cryptographic Coprocessor is a hardware security module (HSM) that incorporates a secure cryptoprocessor embedded on a tamper-resistant, programmable PCIe card. This device combines dedicated cryptographic circuitry, a microprocessor, memory components, and a random number generator within an environment designed to detect and respond to tampering, facilitating secure cryptographic operations and data handling. Confidential key material is safeguarded inside the device’s protected physical perimeter.
Engineered to comply with FIPS PUB 140-2 Level 4—the most stringent certification for commercial cryptographic hardware—the 4769 plays a key role in IBM’s enterprise-wide encryption and security frameworks. IBM provides two main cryptographic system implementations:
- IBM Enterprise PKCS11 (EP11), which implements the PKCS#11 standard API, offers a robust security solution tailored for applications requiring this widely adopted interface.
- The IBM Common Cryptographic Architecture (CCA) delivers a broad range of cryptographic capabilities aimed at the financial industry, including distributed key management and customizable cryptographic processing.
Typical applications encompass financial PIN processing, communications between banks and clearinghouses, EMV chip card transactions, and versatile cryptographic operations utilizing symmetric keys, hashing functions, and public key algorithms.
Operational keys—whether symmetric or asymmetric private keys such as RSA or Elliptic Curve—are generated internally by the coprocessor and stored in encrypted form under the master key within keystore files or application memory. Keys encrypted under the master key can be accessed by any coprocessor sharing that master key. The 4769 offers hardware acceleration for Elliptic Curves 25519 and Ed448 and supports format-preserving encryption (FPE) schemes including FF1, FF2, FF2.1, FF3, and FF3.1.
IBM supports deployment of the 4769 on select IBM Z mainframe systems as Crypto Express7S (CEX7S), identified by feature codes 0898 and 0899. The 4769/CEX7S forms a fundamental component of IBM’s pervasive encryption approach to protect data throughout enterprise infrastructures.
External links
General introduction to cryptography: https://www.garykessler.net/library/crypto.html
Standards related to cryptography:
ISO 13491 - Secure Cryptographic Devices: https://www.iso.org/standard/61137.html
ISO 9564 - PIN security: https://www.iso.org/standard/68669.html
ANSI X9.24 Part 1: Symmetric Key Management Techniques: https://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.24-1-2017
ANSI X9.24 Part 2: Asymmetric Key Management Techniques: https://webstore.ansi.org/RecordDetail.aspx?sku=ANSI+X9.24-2-2016
FIPS 140-2 standard documentation: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf
Payment Card Industry (PCI) PIN Transaction Security (PTS): HSM Modular Security Requirements: https://www.pcisecuritystandards.org/document_library