SAF may be invoked to verify the caller is authorized to use this callable service, the key label, or internal secure key tokens that are stored in the CKDS or PKDS.

On a CCF system, only a DATA key token or DATA key label can be used in this service.

Single and double length CIPHER and ENCIPHER keys are supported on a PCIXCC, CEX2C, or CEX3C.

The Encipher - DES access control point controls the function of this service.

This table lists the required cryptographic hardware for each server type and describes restrictions for this callable service.

Table 131. Encipher required hardware

Server	Required cryptographic hardware	Restrictions
IBM zSeries 900	Cryptographic Coprocessor Feature
IBM zSeries 990 IBM zSeries 890	PCI X Cryptographic Coprocessor Crypto Express2 Coprocessor	If keyword CDMF is specified or if the token is marked as CDMF, the service fails.
IBM System z9 EC IBM System z9 BC	Crypto Express2 Coprocessor	If keyword CDMF is specified or if the token is marked as CDMF, the service fails.