System recommended content:
1. HPE XP8 Encryption User Guide (v08)
2. HPE StoreEver MSL Tape Libraries Encryption Key Server Configuration Guide
Please click on "Thumbs Up/Kudo" icon to give a "Kudo".
Thank you for being a HPE valuable community member.
Ho DoJu,
in most cases, you simply add an Encryption Password to the Backup Software.
After setting, all Data that lands on the Tape is encrypted with this Password.
If the Tape Drive has an Encryption Chip (as Yours), it is done by Hardware, if not by the Backup Software.
Hardware is preferred as faster and can also use compression (on Tape Drive).
Additionally, you can set if the Password is stored in the Software (Backup Server) or not.
If stored, you can restore on this Backup Server without entering a password, if not you need every time a Password for Tape access.
If you need more Security, you can use a Secure Manager or a USB Stick in the Tape that gives a Token for every Tape.
Most time we use Hardware Encryption with stored Passwords, this gives safe for "Lost" Tapes.
See here: Administration Guide (arcserve.com)
Page 114-116
Arcserve® Backup for Windows Administration Guide
Cali
I'm not an HPE employee, so I can be wrong.
I'm not an Arcserver customer and it has been a long time since I looked at it but my recollection is that Arcserve owns the encryption key and stores it in an Arcserve database so all of the key management is done by Arcserve. With a quick search I found a picture that seems to show that in the Arcserve documentation. Don't know if the link will come through but I'll try.
I can tell you that anybody that says a standalone tape drive can't use hardware encryption is forgetting that there are two tape hardware encryption usage models. Tape library managed LTO hardware encryption and software managed LTO hardware encryption. Software that has implemented software managed LTO hardware encryption can use tape drives in a tape library or standalone tape drives and encrypt on either. Only the tape library managed LTO hardware encryption can't be used with standalone tape drives.
HPE only sells tape library managed LTO hardware encryption but the LTO tape drives HPE sells will work with software managed LTO hardware encryption.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]
Good Dokument, but I don't understand your problem.
Every LTO-4 Drive and later has a Hardware Encryption Chip (Stand-alone or Library).
If you set an Encryption Password (Pass Phrase) in ArcServe by "Encrypted Data Option", all Data on the Tape is now Encrypted.
This is, what do you like?
You don't need a Key Management (Internal or external) for this.
In the document above, it is named: Keys managed by ISV application but encryption is LTO hardware based
The only behavior is, that all Tapes are Encrypted with the same Password.
But normally, this is good enough.
Arcserve® Backup for Windows Administration Guide
Cali
I'm not an HPE employee, so I can be wrong.
From the online documentation it looks like Arcserve either uses a password or integrates with a KMIP key server. If you are using a password then the password is your "key" and you are responsible for the key management. Arcserve has a way that you can have it save your password in an ecrypted format in a database but you should still manage your passwords. If you integrate with a KMIP key server then the key server manages the encryption keys.
It sounds like you are probably using a password. The following is all I found on how passwords are used with a simple search of the Arcserve documentation. It doesn't seems to very clearly describe how it uses hardware encryption.
"You can also create a session encryption password that is saved to the Arcserve Backup database. This password is used to encrypt session data. For more information about passwords, see the topic How Password Management Works."
From your earlier comments I suspect that Arcserve support was telling you that they just pass through the password you provide in the SPOUT command and the tape drive uses that password as the encryption key.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]
If somebody from HPE told you that hardware encryption is not possible with standalone tape drives, I'm sorry but whoever said that was wrong. I will let key people in the tape team know that there is some misinformation being shared. I just confirmed that the HPE LTO-8 standalone drive user's guide discusses software managed encryption and that the application is responsible for the keys.
When software is managing the encryption there is very little HPE can do to provide help. There is an encryption LED on the front of the drive but it isn't perfect. It lights up if all the data on the tape is encrypted or if there is a header that isn't encrypted and the rest of the tape is encrypted but if an application writes some unecrypted data in the middle of the tape the light will go out but the drive might still be encrypting. That is rare, I don't think Arcserve does that so you should see the encryption LED lit.
If you want to use the HPE Library and Tape Tools diagnostic tool to pull a support ticket from the drive when there is a tape in use then it is possible to tell that encryption is enabled. I don't recall exactly how that is displayed but the LTT user's guide might say.
For security purposes there is very little encryption information reported out from the tape drive.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]
Point 1, you can see in the GUI if your Tape does Support Hardware Encryption.
As far as I know, every LTO-4 and newer from every Vendor did have the Chip if Single Drive or Library.
Check it here: Can we use the hardware encryption with arcserve?
Point 2, as I wrote, you can Store the Password in the Backup Database or not.
If not, you need to enter the Password for every Restore.
See here: Arcserve Backup session password and encryption key management
The use of a KMS Server or USB Stick is Optional and a different (complex) thing.
Your provided document above explains this.
Cali
I'm not an HPE employee, so I can be wrong.
I went and researched this using the case # information you provided. I was able to locate the lab egineer that is supporting the agent.
Some of the confusion comes from a response from HPE support that was probably not as clear as it could have been. The HPE support agent indicated that "we cannot use Hardware Encryption" but went on to say that a key could have been provided by the backup application. What the support agent meant to convey was that the hardware "managed" encryption solutions sold and supported by HPE could not be used. Software "managed" encryption was able to be used and that would be sold and supported by your backup application vendor. The "managed" part was implied, not stated, and that was easily misinterpreted.
The LED on the front of the drive indicates that the drive is encrypting. The L&TT support ticket information indicates that the tape contains encrypted data. That is about all the information that HPE can provide on software managed encryption. HPE can report that the software is enabling encryption, the drive is writing encrypted data, and that the data on the tape is encrypted.
You have to talk with your application vendor for any information about what encryption keys are used and how they are managed.
If you are able to use your password to read the tapes somewhere else then your application is somehow using the password either as the encryption key or to generate or lookup an encryption key.
I saw some questions about an example in the HPE encryption white paper about an example showing a software tool loading an encryption key into the drive and the tool showed the key. There was a question where that tool was for customers. That tool was a test tool that is used to load specific encryption keys into the drive for testing purposes and was used as an example to show software loading a key into a drive. Your application software performs that function in production. Keys should never be exposed the way they are in that test tool and it is impossible for that test tool or any other to read encryption key information out of the drive. Encryption keys are never stored on a tape, not even in an encrypted form. The encryption keys are only used to generate media keys that are then used for writing data which is able to be read back with the original encryption key. At most an encryption key label or name is able to be stored on the tape. The application software either has to use external information such as a barcode or a password to lookup or generate an encryption key or it could store an encryption key label/name on the tape and read that then go lookup an encryption key. To read encrypted data the encryption key has to be loaded into the drive from the application software. When the drive reads data it takes the encryption key provided by the application and attempts to decode the data. If the decode is successful then the drive returns the data, otherwise it returns an error.
Hopefully this information resolves your questions for HPE and I apologize for the response that was not as clear as it could have been.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]