VMS Backup encryption

[Phil Jamieson]

Does the encryption product alter ANSI labels of backup tapes? Does it do ANYTHING with Backup's normal label processing?

[Anton van Ruitenbeek]

Phil,

Which encryption product ?

AvR

[Ian Miller.]

"Which encryption product ?"
There is a layered product called ENCRYPT from DEC/CPQ/HP which provides an encryption API and a facility for BACKUP to encrypt savesets.
Interestingly there is a kit for it on the VMS V8.2 CD.

From what I can see in the manaual from the kit only the savesets are encrypted.

[Phil Jamieson]

The encryption product I'm thinking of is the one that enables encrypted savesets. I gather it's called Data Encryption Facility. It's gotten to via BACKUP/ENC

Just wondering how it works with ANSI labels on tapes.

[Eberhard Wacker · Accepted solution]

Hi, the product is called "Encryption for OpenVMS" and the latest version is 1.6 from 2001. The contents of the saveset (the file copies and the file information) are encrypted not the saveset file itself. The saveset file is standard RMS and so also label processing is standard VMS.
Cheers,
Eberhard

[Ian Miller.]

Phil, thats the one and V1.6 is on the VMS V8.2 CDs. I'm not sure what the licencing of this product is now i.e. do you have to buy another licence.

[Phil Jamieson]

That about does it then. Thanks for the info.

Phil Jamieson
Software Partners, Inc.

[Tom O'Toole]

Does anybody have a good solution to the following? -- encryption of data kills compressibility of the data.

It would be OK to compress first, but that

1) uses significant cpu cycles
2) makes backup/restore a two step process
3) wastes the hardware compression of available tape drives

If backup had a both /encrypt and /compress qualifiers, it would at least take care of 2) (obviously compress and encrypt would have to be done in the correct order).

What would be ideal is the encryption to be done within the tape drive, after the compression. Tape libraries could be equipped with smart cards. The drive would be designed to do the compress, then the encription (and vice versa on restore).

Does anybody know if such a device exists or is in the works?

[Steven Schweda]

> Does anybody have a good solution to the
> following? -- encryption of data kills
> compressibility of the data.

I can't speak for all encryption schemes, but
old (2.6.2) PGP documentation says:

Note that PGP attempts to compress the
plaintext before encrypting it.

If compression is built into the encryption
(so the CPU time is already wasted), where's
the problem?

Re-phrased: If encryption kills compressibility
by compressing, ...

[Tom O'Toole]

Steven,

Yes, absolutely, that's great if backup/encrypt, of particular interest here, does some compression of the data. Anybody know if this is the case?

As encrypted tapes become the rule rather than the exception, should compression capability be taken out of tape drives, and the price lowered commensurately, if it's not going to be used effectively?