HP StoreEver MSL2024, MSL4048, MSL8048, and MSL8096 Tape Libraries User and Service Guide (AK378-96059, December 2012)

To use the encryption kit, a key server token is inserted in the USB port on the back of the library,
and encryption is enabled and configured from the RMI.
The encryption kit supports your manual security policies and procedures by providing secure
storage for encryption keys. Access to the key server tokens and their backup files is protected with
user-specified passwords. You will need to create processes to protect the tokens and secure the
passwords.
IMPORTANT: When encryption is enabled with the encryption kit, the library will not use encryption
keys from other sources, such as a key management system or application software. Disable
encryption in applications writing to the library when encryption is enabled with the encryption
kit. Applications that attempt to control encryption while encryption is enabled with the encryption
kit will not be able to do so, which can cause backups or other write operations to fail.
See the encryption kit user guide for additional information on using the encryption kit.
Using application-managed encryption
Hardware encryption is turned off by default and is switched on by settings in your backup
application, where you also generate and supply the encryption key. Your backup application
must support hardware encryption for this feature to work. For a current list of suitable backup
software, see the EBS compatibility matrix on the EBS website at http://www.hp.com/go/ebs.
NOTE: The library can only obtain encryption keys from one source. Using the encryption kit will
prevent application-managed encryption.
Encryption is primarily designed to protect the media once it is offline and to prevent it being
accessed from another machine. You will be able to read and append the encrypted media without
being prompted for a key as long as it is being accessed by the machine and application that first
encrypted it.
There are two main instances when you will need to know the key:
• If you try to import the media to another machine or another instance of the backup application
• If you are recovering your system after a disaster
NOTE: Encryption with keys that are generated directly from passwords or passphrases may be
less secure than encryption using truly random keys. Your application should explain the options
and methods that are available. Please refer to your application's user documentation for more
information.
If you are unable to supply the key when requested to do so, neither you nor HP Support will be
able to access the encrypted data.
This guarantees the security of your data, but also means that you must be careful in the management
of the encryption key used to generate the tape.
CAUTION: You should keep a record or backup of your encryption keys and store them in a
secure place separate from the computer running the backup software.
For more information about AES encryption, encryption keys, and using hardware encryption with
your HP Ultrium tape drive, see the White Papers on http://h18006.www1.hp.com/storage/
tapewhitepapers.html.
For detailed instructions about enabling encryption please refer to the documentation supplied with
your backup application or with the encryption kit. This will also highlight any default states, for
example when copying tapes, that may need changing if using encrypted tapes.
18 Features and overview