topic Re: Encryption Questions in Operating System - OpenVMS

Encryption Questions

The Brit — Mon, 14 Sep 2009 10:51:01 GMT

I notice that when defining Keys for use with backups, the keys are stored in the "Key Storage Table" as logicals, and that the logicals can be Process, Job, Group or System level logicals.

I have three main questions.

1. Does this mean that a backup tape must be restored (and decrypted) on the same node that backed it up??

2. How do the Keys survive across system boots?? Are they stored in a file somewhere??

3. If the answer to Q1 is "yes", then is it likely that there will be a "/Cluster" option in a future release??

thanks.

Dave.

Re: Encryption Questions

Hoff — Mon, 14 Sep 2009 12:02:07 GMT

1: No. If the key is known, the data can be decrypted. That sort of thing would greatly reduce the ability to decrypt data during DT recovery.

2: Loaded keys do not "survive" reboot. Required keys need to be reloaded upon each reboot. "The key is available for use until the system is rebooted" (or until cleared).

3: Ask HP.

Here's the (old) read of the topic:

http://h71000.www7.hp.com/doc/82final/6477/6477pro.pdf

Re: Encryption Questions

Andy Bustamante — Mon, 14 Sep 2009 15:39:29 GMT

We use a keys.com to define encryption keys. You'll need to save your key(s) for worst case scenario. The logicals are disabled in an encrypted state and don't appear in plain text.

Your alternative is a manual process to define keys on following reboot. Define the the process and define who will access the key file.

Would anyone else use Encryption in Save_Set_Manager?

Andy Bustamante

Re: Encryption Questions

The Brit — Mon, 14 Sep 2009 16:36:15 GMT

Andy,
would you be prepared to share the "keys.com" script?, either here, or privately. I can be contacted at;

baxterd at TESSCO dot com.

Thanks

Dave.

Re: Encryption Questions

Andy Bustamante — Mon, 14 Sep 2009 20:30:44 GMT

I'm putting up an obviously sanitized example. Depending on system, we either call keys.com from systartup_vms.com, or from a captive operator menu which submits encrypted backup jobs. Depending on the system we directly create encrypted backups or use save_set_manager to copy save sets then create encrypted copies of save_set(s) on disk.

Don't forget to include your key(s) in off site planning and work out recovery.

Andy

Re: Encryption Questions

Hoff — Mon, 14 Sep 2009 20:46:53 GMT

It's just a DCL wrapper around a wad of ENCRYPT /CREATE_KEY commands, really.

That DCL might be loaded in from external media, or decrypted from disk storage or otherwise.

I might look to use a USB key disk here (or a removable storage brick) that's connected and mounted and accessed only during a typical sequenced bootstrap. With a clone located offsite.

Re: Encryption Questions

The Brit — Mon, 14 Sep 2009 20:51:05 GMT

Thanks Andy, Steve,

Thank you both for your help. I think I can figure it out from here. (But dont worry, if I cant, I'll be back)

Dave.

Re: Encryption Questions

The Brit — Mon, 14 Sep 2009 20:51:50 GMT

See above.