About encryption keys

How the encryption key server processes encryption keys

TS1120 and later tape drives

In system-managed and library-managed tape encryption, unencrypted data (clear text) is sent to the tape drive and converted to ciphertext with a symmetric 256-bit AES Data Key (DK) generated by the encryption key server. The ciphertext is then written to tape. The encryption key server uses a single, unique data key for each 3592 Tape Cartridge. This data key is also encrypted, or wrapped, by the encryption key server with the public key from an asymmetric Key Encrypting Key (KEK) pair. This process creates an Externally Encrypted Data Key (EEDK). The EEDK is written to the cartridge memory and to three more places on the tape media in the cartridge. The tape cartridge now holds both the encrypted data and the means to decrypt it for anyone that is holding the private part of the KEK pair. Figure 1 illustrates this process.

The data key is also wrapped a second time, possibly with the public key of another party, to create an extra EEDK. Both EEDKs can be stored on the tape cartridge. In this way, the tape cartridge can be shipped to a Business Partner that is holding the corresponding private key that would allow the data key to be unwrapped and the tape that is decrypted by the Business Partner.

LTO Ultrium 4 Tape Drive

In system-managed and library-managed tape encryption, unencrypted data is sent to the LTO Ultrium 4 Tape Drive and converted to ciphertext with a pre-generated symmetric Data Key (DK) from a keystore. The data is available to the Encryption Key Manager, and is then written to tape. The Encryption Key Manager selects a pre-generated Data Key in round robin fashion. Data Keys are reused on multiple tape cartridges when an insufficient number of Data Keys are pre-generated. The Data Key is sent to the LTO 4 tape drive in encrypted, or wrapped, form by the Encryption Key Manager. The LTO 4 tape drive unwraps this Data Key and uses it to complete encryption or decryption. However, no wrapped key is stored anywhere on the LTO 4 tape cartridge. This procedure is a major difference between the way TS1120 or TS1130 and LTO devices operate with the Encryption Key Manager. When the encrypted volume is written, the Data Key must be accessible based on the alias or key label. It must be available to the Encryption Key Manager in order for the volume to be read. Figure 2 illustrates this process.

The Encryption Key Manager also gives you the ability to organize your symmetric keys for LTO encryption into key groups. In this way, you can group keys according to the type of data they encrypt, the users who have access to them, or by any other meaningful characteristic. See Creating and managing key groups.

Encryption key processing by other applications (an encryption key server not used)

TS1120, TS1130, and LTO Ultrium 4 Tape Drives

In application-managed tape encryption, unencrypted data (clear text) is sent to the tape drive and converted to ciphertext with a symmetric Data Key (DK) provided by the application, and is then written to tape. The data key is not stored anywhere on the tape cartridge. When the encrypted volume is written, the data key must be in a location available to the application, a server database, for example, in order for the volume to be read.

TS1120 and laterand LTO Ultrium 4 tape drives can use applications such as Tivoli Storage Manager for application-managed encryption. Tivoli Storage Manager uses a single, unique data key for each tape cartridge.

Alternatively, the tape drives can be used by applications that use the T10 command set to complete encryption. The T10 command set uses symmetric 256-bit AES keys that are provided by the application. T10 can use multiple, unique data keys per tape cartridge, and even write encrypted data and clear data to the same tape cartridge. When the application encrypts a tape cartridge, it selects or generates a data key with a method determined by the application and sends it to the tape drive. The key is not wrapped with an asymmetric public key and it is not stored on the tape cartridge. When the encrypted data is written to tape, the data key must be in a location available to the application in order for the data to be read.

The process for application-managed tape encryption (and system-managed and library-managed encryption on LTO) is shown in Figure 2.

Summary

The number of encryption keys that can be used for each volume depends on the tape drive, the encryption standard, and method that is used to manage the encryption. For transparent encryption of LTO 4, (that is, with system-managed or library-managed encryption with the Encryption Key Manager,) the uniqueness of Data Keys depends on the availability of enough pre-generated keys to the Encryption Key Manager.