OpenSSL on IBM Z - out of the box

With the default configuration, all cryptographic operations are executed inside of OpenSSL with built-in support for mainly symmetric ciphers and hash functions. These algorithms are executed using one of the acceleration methods mentioned in Table 1, for example, the CPACF feature. CPACF requires specific microcode to be installed which you can order as no-charge feature code (LIC #3863), unless you are in an embargoed geography. The CPACF built-in support has been implemented for example, for the AES and SHA algorithms inside of OpenSSL. This means that the supported algorithms will always execute faster than pure C code, due to the automatic use of the OpenSSL built-in CPACF support.

Table 1 lists all algorithms that are implicitly accelerated by OpenSSL. The table is valid for OpenSSL versions 1.1.1 or later. It is also only valid for builds that are configured without option no-asm, which explicitly disables the usage of all CPACF processing. Also, if for any of the mentioned algorithms, the required hardware is not available, then the processing is conducted transparently for the requestor with OpenSSL software implementation.