topic Re: VMS Backup encryption in Operating System - OpenVMS

VMS Backup encryption

Phil Jamieson — Mon, 16 May 2005 16:48:52 GMT

Does the encryption product alter ANSI labels of backup tapes? Does it do ANYTHING with Backup's normal label processing?

Re: VMS Backup encryption

Anton van Ruitenbeek — Tue, 17 May 2005 03:35:09 GMT

Phil,

Which encryption product ?

AvR

Re: VMS Backup encryption

Ian Miller. — Tue, 17 May 2005 04:02:43 GMT

"Which encryption product ?"
There is a layered product called ENCRYPT from DEC/CPQ/HP which provides an encryption API and a facility for BACKUP to encrypt savesets.
Interestingly there is a kit for it on the VMS V8.2 CD.

From what I can see in the manaual from the kit only the savesets are encrypted.

Re: VMS Backup encryption

Phil Jamieson — Tue, 17 May 2005 07:48:36 GMT

The encryption product I'm thinking of is the one that enables encrypted savesets. I gather it's called Data Encryption Facility. It's gotten to via BACKUP/ENC

Just wondering how it works with ANSI labels on tapes.

Re: VMS Backup encryption

Eberhard Wacker — Tue, 17 May 2005 07:54:30 GMT

Hi, the product is called "Encryption for OpenVMS" and the latest version is 1.6 from 2001. The contents of the saveset (the file copies and the file information) are encrypted not the saveset file itself. The saveset file is standard RMS and so also label processing is standard VMS.
Cheers,
Eberhard

Re: VMS Backup encryption

Ian Miller. — Tue, 17 May 2005 08:27:12 GMT

Phil, thats the one and V1.6 is on the VMS V8.2 CDs. I'm not sure what the licencing of this product is now i.e. do you have to buy another licence.

Re: VMS Backup encryption

Phil Jamieson — Tue, 17 May 2005 08:41:00 GMT

That about does it then. Thanks for the info.

Phil Jamieson
Software Partners, Inc.

Re: VMS Backup encryption

Tom O'Toole — Tue, 01 Nov 2005 20:38:26 GMT

Does anybody have a good solution to the following? -- encryption of data kills compressibility of the data.

It would be OK to compress first, but that

1) uses significant cpu cycles
2) makes backup/restore a two step process
3) wastes the hardware compression of available tape drives

If backup had a both /encrypt and /compress qualifiers, it would at least take care of 2) (obviously compress and encrypt would have to be done in the correct order).

What would be ideal is the encryption to be done within the tape drive, after the compression. Tape libraries could be equipped with smart cards. The drive would be designed to do the compress, then the encription (and vice versa on restore).

Does anybody know if such a device exists or is in the works?

Re: VMS Backup encryption

Steven Schweda — Wed, 02 Nov 2005 00:16:38 GMT

> Does anybody have a good solution to the
> following? -- encryption of data kills
> compressibility of the data.

I can't speak for all encryption schemes, but
old (2.6.2) PGP documentation says:

Note that PGP attempts to compress the
plaintext before encrypting it.

If compression is built into the encryption
(so the CPU time is already wasted), where's
the problem?

Re-phrased: If encryption kills compressibility
by compressing, ...

Re: VMS Backup encryption

Tom O'Toole — Wed, 02 Nov 2005 11:50:25 GMT

Steven,

Yes, absolutely, that's great if backup/encrypt, of particular interest here, does some compression of the data. Anybody know if this is the case?

As encrypted tapes become the rule rather than the exception, should compression capability be taken out of tape drives, and the price lowered commensurately, if it's not going to be used effectively?

Re: VMS Backup encryption

Guy Peleg — Mon, 14 Nov 2005 00:35:32 GMT

BACKUP/ENCRYPT encrypts all the saveset
records other than the header.
In the saveset header - only the command
typed by the user is encrypted, the rest of
the header is not encrypted.

BACKAP/ENCRYPT does not compress the data,
backup sends the encrypt facility 16 bytes
buffers for encryption and encrypt is
returning 16 bytes worth of encrypted data
so no comression.

Up until V8.2 BACKUP only support DES
encryption which is expensive (performance
wise). With the next version of the O/S
BACKUP will support AES encryption which is much stronger encryption and very cheap performance wise.

Also note that starting with V8.2 the
encrypt product is covered by the base O/S
license so no separate PAK is required.

As for data compression in BACKUP - this is
on the list and may show up in the near
future (however no promise).

fwiw,

Guy Peleg
OpenVMS Engineering

Re: VMS Backup encryption

Guy Peleg — Mon, 14 Nov 2005 00:37:02 GMT

oh...and to answer the question that
triggered this discussion - the label
of the tape does not change (not encrypted).

Guy

Re: VMS Backup encryption

Tom O'Toole — Mon, 14 Nov 2005 19:39:07 GMT

Guy,

This sounds a great. I have run some (very rough, to the null device) backup performance tests on 8.2 (both alpha and itanium and the results are similar). The DES encryption seems to require significant additional resources, almost certainly enough to prevent a modern tape drive from streaming. The new version sounds like just what the doctor ordered, in terms of backup performance, and strength of encryption.

A certain amount of compression is also a nice to have, but not as critical. Thanks!