[WTB] Hardware encryption license key for IBM TS-3200 tape library

[Jellyfish]

Looking to ideally just buy a license, though I would also consider buying a library with the key installed on it (within Europe to limit shipping cost). I believe a license key for/from an IBM TS-3100 would also work.

Please message me if you have one you could sell or know where I could get one!

 

[BoredSysadmin]

Sorry for the slight off-topic; I'm curious why you insist that encryption be done on the tape library level and not backup software. Wouldn't it make the encrypted tapes not readable on a different library (assuming you replace this one eventually?)

 

[Jellyfish]

From what I read it seems that hardware encryption is several times faster than software encryption, which I've read can be almost unusably slow to the point of causing shoe-shining on the tape (even when reading data from fast ZFS array as data source).

I already bought spares of the parts that are prone to breaking (picker robot and robot track), so I'm hoping to not have to change library for quite a while and hadn't really considered compatibility with other libraries. Is it definitely not possible to migrate the hardware key to a different library if this library failed completely? Thanks for the input.

 

[BoredSysadmin]

I can't speak about this library if its key could be migrated. My guess is no, but I can't be 100% sure. I used to manage Backup Exec on a reasonably old server with Dell LTO library, and I haven't noticed performance slowdown once we implemented software-level encryption. It doesn't sound logical to me that tape backup speed would go down to snail's pace just for enabling encryption with a modern cpu.

 

[Stephan]

CPUs used to be too slow, were without AES-NI, and running both Triple-DES encryption and LZ compression on say a Pentium at tape's data speed was a challenge. So people wanted encryption plus compression done within the drive. I imagine the IBM ppc CPU has accelerators for both. In that scheme backup software also isn't bothered to implement it.

If you pull encryption from drive into CPU, then drive compression will no longer be able to compress the fully random stream at all. Nil. Then you'd also have to run compression on CPU, then encryption on CPU, in that order, and send that stream to tape drive.

With advent of Haswell, AES-NI, and later modern compression methods like LZO, LZ4 or ZSTD, backup software can do everything in software.

I have never implemented TS3x00 encryption on the unit. If tapes are not readable in another library, this would be a deal breaker. Better take your favorite book, extract 10 words from your favorite passage, run that through SHA2-512 and that will be your key, stored in the backup software. If you lose everything but the tapes, all you need is ebay for a drive and a book shop.

For safe keeping (pun intended), I like mid-1990s vintage class IV safes from bank branch closures at 1.5 to 2.5 tonnes per safe.

 

[Jellyfish]

Looks like I won't be able to get a hardware encryption key, I've contacted several places, but got nothing. Glad I asked here though, as it does sound like software encryption is the better way to go anyway! I plan on using a Xeon E3-1230v3 which does have AES-NI, so that should be good.

Cool trick for the key, I'll keep that in mind when setting it up.