NAME¶

tape390_crypt - encryption support for zSeries tape devices.

SYNOPSIS¶

tape390_crypt [OPTION] [DEVICE]

DESCRIPTION¶

tape390_crypt exploits encryption features available in zSeries tape devices. It can be used to enable or disable tape encryption and to set KEK (Key Encrypting Key) labels.

OPTIONS¶

-h or --help

Print help information, then exit.

-v or --version

Print version information, then exit.

-q or --query

Print current encryption status of the specified tape device and of the loaded medium. If encryption is on and the medium is encrypted , additional information on the encryption keys is displayed.

-e {on|off} or --encryption={on|off}

sets tape encryption on or off.

-k <value>[<char>label|<char>hash] or --key=<value>[<char>label|<char>hash]

sets tape encryption keys.
<value> specifies the KEK (Key Encrypting Key), which can be maximal 64 characters long.
The store type (either label or hash) specifies how the KEK in <value> is to be stored on the tape medium. Since labels are human readable strings and hence more user friendly than hashes, the default store type is label.
The -k option can only be specified, if the tape medium is at load point.
While processing the -k option, the tape medium is initialized and all data eventually contained on the tape medium is lost. To avoid inadvertent data loss a prompt message is issued asking the user whether he or she really wants to proceed.
The -k option can be specified maximal twice, because on the tape medium maximal two EEDKs (External Encrypted Data Keys) can be stored. If specified once, two identical EEDKs are stored.
<char> is a character separating the KEK in <value> from the store type (either label or hash). This delimiter can be specified with the -d option as explained below.

-d <char> or --delimiter=<char>

specifies the character which separates the KEK in <value> from the store type (either label or hash). The default delimiter is : (colon). The -d option can only be specified together with the -k option.

-f or --force

specifies that no prompt message is to be issued before writing the KEK information and initializing the tape medium. The -f option can only be specified together with the -k option.

device

specifies the device node of the tape device.

EXAMPLES¶

1. Scenario:
mount non-encrypted tape and write data with the default KEKs:
tape390_crypt -e on /dev/ntibm0
tar cfz /dev/ntibm0 /data

2. Scenario:
mount non-encrypted tape and write data with specific KEKs:
tape390_crypt -k my_first_key -k my_second_key:hash /dev/ntibm0
tar cfz /dev/ntibm0 /data

3. Scenario:
mount tape and display current encryption status:
tape390_crypt -q /dev/ntibm0