HP 8/80 Fabric OS Encryption Administrator's Guide v6.4.0 (53-1001864-01, June - Page 190

5 Tape data compression Tape data compression Data is compressed by the encryption switch or blade before encrypting only if the tape device supports compression, and compression is explicitly enabled by the host backup application. That means if the tape device supports compression, but is not enabled by the host backup application, then compression is not performed by the encryption switch or blade before encrypting the data. However, if the backup application turns on compression at the tape device and does not turn it off before logout or after the backup or restore operation is complete, and a second host backup application starts using the same tape device and does not explicitly turn off compression, compression will still be on when the encryption switch or blade issues a Mode Sense command to find target device capabilities, and compression is used. In other words, if the host backup application does not turn off compression on the target, the encryption switch or blade uses the compression feature of the target. Conversely, if the tape device does not support compression, the encryption switch or blade does not perform compression before encrypting the data. The same rules apply for decompression. Data is compressed, encrypted and padded with ASCII 0 to the tape block length to simplify handling at the encryption device. It is assumed that a tape target with compression enabled will be unable to compress the seemingly random encrypted data, but will greatly compress the padded zero data that follows. Compressing data at the encryption device in conditions other than above does not create any additional space savings on the tape media. Tape pools When a new tape pool needs to be created, the following steps must be performed: • Configure the tape pool with a maximum of 64 bytes of tape pool label first on the encryption device. The tape pool label configured on the encryption device must be an exact match to the tape pool label configured on the tape backup application. • Set the policies (such as encrypt or cleartext), format (such as native Brocade format or DF-compatible), and optionally specify a key life span for the tape pool. Tape pools are unique across an encryption group. Tape pool configuration takes precedence over LUN level configuration. Tape pool configuration is used only when labeling of tape media is done on the first write for the tape media. After tape labeling is done and metadata written, the tape pool configuration is no longer used. Tape pool configuration is not required for restoring data from the encrypted tape belonging to the tape pool, because the key ID is present in the metadata. When the tape pool label configured on the encryption device does not match with any label that the backup application sends as part of the first write (tape labeling) to the tape media, the tape pool level policies are ignored and default LUN level policies are applied. Tape block zero handling The block zero of the tape media is not encrypted and the data in the block zero is sent as cleartext along with the block zero metadata header prefixed to the data to the tape device. 172 Fabric OS Encryption Administrator's Guide 53-1001864-01