Magnetic tapes, CDs, and DVDs can be encrypted using AES256 or TDES encryption for protection of sensitive data. The following algorithms are available to encrypt tapes and CDs: AES-GCM, and 3DES and AES256 in CBC mode, using ESSIV to generate a random IV.

In addition to tape volume security, in which a tape can be made private or have a guard file added to protect the tape from unauthorized users, data can be encrypted when copied onto tape.

Library Maintenance tape encryption enables you to have data automatically encrypted when copied to tape, as well as to have data automatically decrypted when read from tape. Encrypted tapes can also be read on other MCP systems if the encryption key is imported to the destination system.

Tape encryption capabilities are handled through Security Center and the Library Maintenance utility of the MCP environment.

Security Center provides the key management functions in which encryption keys are obtained, stored, and exported to other MCP systems where encrypted tapes can be decrypted.

Testing your tape encryption process and backups of data and encryption keys is strongly encouraged. There is no way to recover encrypted data if the encryption key is lost or corrupted.

Enterprise Database Server Tape Encryption

Enterprise Database Server files can be encrypted to tape using library maintenance, DMUTILITY, and COPYAUDIT.

MCP TapeStack Utility

The MCP TapeStack utility reads multiple source tapes in their native format and writes them in an encoded (stacked) format to a single destination tape. The MCP TapeStack utility settings supports both AES256 and 3DES encryption. Enterprise Database Server and COPYAUDIT tapes can be stacked as well.