VMS Backup encryption

[Guy Peleg]

BACKUP/ENCRYPT encrypts all the saveset
records other than the header.
In the saveset header - only the command
typed by the user is encrypted, the rest of
the header is not encrypted.

BACKAP/ENCRYPT does not compress the data,
backup sends the encrypt facility 16 bytes
buffers for encryption and encrypt is
returning 16 bytes worth of encrypted data
so no comression.

Up until V8.2 BACKUP only support DES
encryption which is expensive (performance
wise). With the next version of the O/S
BACKUP will support AES encryption which is much stronger encryption and very cheap performance wise.

Also note that starting with V8.2 the
encrypt product is covered by the base O/S
license so no separate PAK is required.

As for data compression in BACKUP - this is
on the list and may show up in the near
future (however no promise).

fwiw,

Guy Peleg
OpenVMS Engineering

[Guy Peleg]

oh...and to answer the question that
triggered this discussion - the label
of the tape does not change (not encrypted).

Guy

[Tom O'Toole]

Guy,

This sounds a great. I have run some (very rough, to the null device) backup performance tests on 8.2 (both alpha and itanium and the results are similar). The DES encryption seems to require significant additional resources, almost certainly enough to prevent a modern tape drive from streaming. The new version sounds like just what the doctor ordered, in terms of backup performance, and strength of encryption.

A certain amount of compression is also a nice to have, but not as critical. Thanks!