Optimizing OpenPGP on z/OS

Executive Summary

As OpenPGP usage expands across financial services, healthcare, government, and other highly regulated sectors, traditional z/OS-resident PGP workloads are imposing growing operational and financial burdens. CPU-intensive asymmetric cryptography, increasing partner key counts, and emerging post-quantum requirements are driving higher MSU consumption and escalating Crypto Express hardware dependence.

At the same time, most large enterprises now operate deliberately hybrid environments encompassing z/OS, Linux, Windows, and cloud platforms. These distributed platforms can execute cryptographic workloads at significantly lower cost — but only if integrated with z/OS in a controlled, auditable, and operationally simple manner.

Connect/MP z/OS PGP enables z/OS to retain full operational control while encryption executes on the most cost-effective platform — using the Connect/USS component for native z/OS UNIX System Services (USS) PGP and the Connect/Hybrid component for distributed PGP on z/Linux on IFLs, x86, Windows, or macOS. This architecture delivers a measurable reduction in MSU consumption and minimizes reliance on Crypto Express hardware.

This paper outlines the strategic, financial, and architectural value of this model and explains why Connect/MP provides a materially stronger integration approach than traditional hybrid methods.

---

1. The Challenge: Rising Cost and Complexity of Traditional z/OS PGP

1.1 Asymmetric cryptography drives MSU consumption

Symmetric encryption on z/OS is highly optimized. CPACF accelerates AES and hashing with near-zero CPU cost, and zEDC compresses efficiently. However, asymmetric operations (RSA/ECC key generation, signing, public-key encryption) remain CPU-intensive and are often the dominant contributor to PGP processing cost — especially when encrypting for multiple partners.

1.2 Crypto Express dependence is expensive to sustain

Many organizations originally deployed Crypto Express cards primarily to support OpenPGP workloads. The current cost profile includes:

• Hardware and maintenance
• Power, cooling, cabling
• Software priced per MSU

For organizations with 2–6 Crypto Express cards dedicated to PGP workloads, this represents a substantial annual expense.

1.3 Operational fragility of DIY PGP integration

Historically, hybrid solutions were built using:

• REXX scripts
• Unix shell scripts
• SSH wrappers
• Bespoke conversion utilities

These solutions require specialized expertise that is increasingly scarce. Error handling and auditability vary widely, and maintenance burdens increase as partner key counts grow.

1.4 Post-quantum cryptographic requirements are emerging

Financial institutions and government agencies are beginning to mandate:

• ML-KEM (Kyber)
• ML-DSA (Dilithium)
• SLH-DSA (Sphincs+)

Supporting these algorithms in a cost-effective way on z/OS requires an execution model that can scale flexibly without increasing MSU load.

---

2. The Connect/MP OpenPGP Model: A Better Architectural Approach

Connect/MP’s OpenPGP separates control from execution:

• z/OS remains the system of record: JCL, RACF/ACF2/Top Secret security, SMF/RMF audit, dataset governance, and central policy enforcement remain on the mainframe.
• Encryption runs on the most cost-effective platform: z/OS USS with IBM-ported GnuPG, z/Linux on IFLs, External Linux x86, or Windows/macOS endpoints.
• Keys and workflows stay under z/OS governance. GnuPG keyrings and policies remain centrally managed.

Result: Mainframe organizations gain the flexibility of distributed cryptography with the governance and stability of z/OS.

---

3. Why GnuPG is the Logical Foundation for Hybrid PGP

GnuPG (GPG) remains the global reference implementation of OpenPGP and presents several advantages for mainframe environments.

3.1 No per-MIPS or per-user licensing

GnuPG eliminates the predominant cost driver of many legacy PGP products.

3.2 Active maintenance and rapid security patching

The current 2.4x and 2.6x branches receive fast updates and support modern algorithms such as:

• Curve25519 / Ed25519
• AES-256-GCM
• SHA-3
• PQC algorithms included in NIST’s 2024 selections

3.3 Cross-platform consistency

The same keyrings and command-line syntax operate unchanged across z/OS USS, z/Linux, x86 Linux, Windows, and macOS. The “write once, use anywhere” model reduces operational variance and simplifies validation.

3.4 FIPS-aligned cryptography

While GnuPG itself is not a FIPS module, several underlying cryptographic components (e.g., libgcrypt within RHEL, Ubuntu Pro, and SUSE) are validated within FIPS 140-2 or 140-3 certified modules. On z/OS USS, asymmetric operations can leverage ICSF/System SSL, while symmetric operations use CPACF.

---

4. A Governance-First Integration Platform

Connect/MP provides a z/OS-native integration layer that orchestrates hybrid PGP execution without requiring scripting or network staging.

4.1 Direct z/OS integration

Connect/Hybrid runs within the z/OS address space and accesses sequential datasets, PDS/PDSE, GDGs, zFS/HFS files, and STDIN/STDOUT/STDERR streams — avoiding temporary files, manual transfers, and custom BPXBATCH logic.

4.2 Cross-execution orchestration

From standard JCL, Connect/MP can:

• Invoke remote commands on z/Linux, x86 Linux, Windows, or macOS
• Stream data securely via the FIT protocol
• Apply inline encryption and compression
• Return exit codes and stdout/stderr to the batch job

4.3 Simplified operations

Administrators do not need shell scripting or SSH expertise. All hybrid behavior is configured declaratively.

4.4 Auditing and compliance

• z/OS side: SMF records
• Distributed side: syslog/journald logging
• Key management: centralized GnuPG keyrings

This approach ensures that cryptographic execution outside z/OS never results in plain text leaving the trust boundary.

---

5. Deployment Topologies and Their Trade-Offs

Connect/MP PGP can run across multiple platforms with the same JCL. The choice of topology depends on cost, latency, and operational constraints.

5.1 Connect/USS

• Uses IBM-ported GnuPG
• Lowest-latency option
• Leverages zEDC, CPACF and zIIP eligibility
• Requires no distributed infrastructure

Best for: Low-complexity deployments and organizations optimizing for stability rather than maximum cost reduction.

5.2 Connect/Hybrid — z/Linux on IFLs

• Moves CPU costs to IFLs (typically lower cost per unit of compute)
• Uses HiperSockets for high-speed transfer
• Full support for FIPS-aligned crypto modules

Best for: Organizations seeking the strongest balance of cost savings and low latency.

5.3 External Linux x86 (on-prem or cloud)

• Extremely cost-efficient compute
• Supports container-based scaling for peak loads

Best for: Enterprises with variable throughput or cloud adoption initiatives.

5.4 Windows or macOS endpoints

• Useful where partner teams or operational tools run natively on these platforms
• No licensing costs for GnuPG

Best for: Mixed-platform environments and departmental deployments.

---

6. Financial Impact: Reducing MSUs and Eliminating Crypto Express

Across 2024–2025 deployments, organizations adopting hybrid PGP generally report three primary savings categories:

6.1 Crypto Express removal or repurposing

Many enterprises are able to decommission 2–6 cards previously used for PGP batch processing.

6.2 MSU reduction

Offloading asymmetric cryptography to distributed platforms typically lowers overall MSU usage significantly, sometimes yielding seven-figure annual reductions depending on batch volumes and partner key counts.

6.3 Reduced operational overhead

• Less reliance on scarce scripting skills
• Lower maintenance of custom pipelines
• Consistent onboarding of new partners through configuration rather than code

Payback Timeframes

Most organizations adopting Connect/MP PGP achieve a full return on investment within 4–12 months, based on the combination of MSU savings, lower hardware requirements, and reduced operational complexity.

---

7. Security, Governance, and Post-Quantum Readiness

USS or Hybrid execution does not change the z/OS security posture. Keys, datasets, and policies remain controlled by the mainframe.

7.1 Data protection

• End-to-end encrypted pipelines
• No plaintext written to remote systems
• Mutual authentication of endpoints

7.2 Audit and compliance

SMF and syslog/journald provide full traceability across platforms.

7.3 Post-quantum cryptography support

GnuPG versions aligned with current NIST PQC selections give organizations early access to ML-KEM (Kyber), ML-DSA (Dilithium), and SLH-DSA (Sphincs+). These algorithms can be enabled via policy changes without modifying JCL scripts.

---

8. Conclusion: A Practical Path to Modernizing z/OS PGP

As regulatory, operational, and cost pressures rise, organizations need a more efficient and scalable approach to OpenPGP on z/OS. USS and Hybrid execution provides a measurable reduction in MSU consumption, decreases or eliminates Crypto Express dependency, and improves operational resilience — all while retaining the governance and stability of traditional JCL-driven batch operations.

Connect/MP offers a practical, low-risk model for optimizing z/OS OpenPGP:

• Integrates into existing batch workflows — no redesign of job structures, scheduling logic, or dataset flows required
• No custom scripting
• Centralized key and policy governance
• Consistent behavior across z/OS USS, z/Linux, x86, Windows, and macOS
• Pathway to post-quantum readiness

For organizations seeking a cost-efficient, audit-ready, and future-proof approach to z/OS OpenPGP, hybrid execution provides one of the highest-impact modernization opportunities available today.

---

Please rate this document → Click here