Sun Microsystems StorageTek HP LTO4 Reference guide

Sun StorageTekTM Crypto
Key Management System
HP LTO4 Encryption-Capable Tape Drives
Technical Brief
Part Number: 316196601
Revision: A

Sun Microsystems, Inc.
www.sun.com
Crypto Key Management System
Version 2.0
HP LTO4 Tape Drive
Technical Brief
Part Number: 316196601
June 2008
Revision: A

Copyright © 2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A. All rights reserved.
Sun Microsystems, Inc. has intellectual property rights relating to technology embodied in the product that is described in this
document.In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at
http://www.sun.com/patents and one or more additional patents or pending patent applications in the U.S. and in other countries.
THIS PRODUCT CONTAINS CONFIDENTIAL INFORMATION AND TRADE SECRETS OF SUN MICROSYSTEMS, INC. USE,
DISCLOSURE OR REPRODUCTION IS PROHIBITED WITHOUT THE PRIOR EXPRESS WRITTEN PERMISSION OF SUN
MICROSYSTEMS, INC.
Use is subject to license terms. This distribution may include materials developed by third parties.This distribution may include
materials developed by third parties.Parts of the product may be derived from Berkeley BSD systems, licensed from the University of
California.
UNIX is a registered trademark in the U.S. and in other countries, exclusively licensed through X/Open Company, Ltd.Sun, Sun
Microsystems, the Sun logo, Solaris, Sun StorageTek Crypto Key Management System, StorageTek and the StorageTek logo are
trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries.
Products covered by and information contained in this service manual are controlled by U.S. Export Control laws and may be subject
to the export or import laws in other countries. Nuclear, missile, chemical biological weapons or nuclear maritime end uses or end
users, whether direct or indirect, are strictly prohibited. Export or reexport to countries subject to U.S. embargo or to entities identified
on U.S. export exclusion lists, including, but not limited to, the denied persons and specially designated nationals lists is strictly
prohibited. Use of any spare or replacement CPUs is limited to repair or one-for-one replacement of CPUs in products exported in
compliance with U.S. export laws. Use of CPUs as product upgrades unless authorized by the U.S. Government is strictly prohibited.
DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR
NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY
INVALID.
Copyright © 2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, Etats-Unis. Tous droits réservés.
Sun Microsystems, Inc. détient les droits de propriété intellectuels relatifs à la technologie incorporée dans le produit qui est décrit
dans ce document.
En particulier, et ce sans limitation, ces droits de propriété intellectuelle peuvent inclure un ou plus des brevets américains listés à
l'adresse http://www.sun.com/patents et un ou les brevets supplémentaires ou les applications de brevet en attente aux Etats - Unis
et dans les autres pays.
CE PRODUIT CONTIENT DES INFORMATIONS CONFIDENTIELLES ET DES SECRETS COMMERCIAUX DE SUN
MICROSYSTEMS, INC. SON UTILISATION, SA DIVULGATION ET SA REPRODUCTION SONT INTERDITES SANS L
AUTORISATION EXPRESSE, ECRITE ET PREALABLE DE SUN MICROSYSTEMS, INC.
L'utilisation est soumise aux termes de la Licence.Cette distribution peut comprendre des composants développés par des tierces
parties.Cette distribution peut comprendre des composants développés par des tierces parties.Des parties de ce produit pourront être
dérivées des systèmes Berkeley BSD licenciés par l'Université de Californie.
UNIX est une marque déposée aux Etats-Unis et dans d'autres pays et licenciée exclusivement par X/Open Company, Ltd.Sun, Sun
Microsystems, le logo Sun, Solaris, Sun StorageTek Crypto Key Management System, StorageTek et le logo StorageTek sont des
marques de fabrique ou des marques déposées de Sun Microsystems, Inc. aux Etats-Unis et dans d'autres pays.
Ce produit est soumis à la législation américaine en matière de contrôle des exportations et peut être soumis à la règlementation en
vigueur dans d'autres pays dans le domaine des exportations et importations. Les utilisations, ou utilisateurs finaux, pour des armes
nucléaires, des missiles, des armes biologiques et chimiques ou du nucléaire maritime, directement ou indirectement, sont strictement
interdites. Les exportations ou reexportations vers les pays sous embargo américain, ou vers des entités figurant sur les listes
d'exclusion d'exportation américaines, y compris, mais de manière non exhaustive, la liste de personnes qui font objet d'un ordre de ne
pas participer, d'une façon directe ou indirecte, aux exportations des produits ou des services qui sont régis par la législation
américaine en matière de contrôle des exportations et la liste de ressortissants spécifiquement désignés, sont rigoureusement
interdites. L'utilisation de pièces détachées ou d'unités centrales de remplacement est limitée aux réparations ou à l'échange standard
d'unités centrales pour les produits exportés, conformément à la législation américaine en matière d'exportation. Sauf autorisation par
les autorités des Etats-Unis, l'utilisation d'unités centrales pour procéder à des mises à jour de produits est rigoureusement interdite.
LA DOCUMENTATION EST FOURNIE “EN L'ETAT” ET TOUTES AUTRES CONDITIONS, DECLARATIONS ET GARANTIES
EXPRESSES OU TACITES SONT FORMELLEMENT EXCLUES, DANS LA MESURE AUTORISEE PAR LA LOI APPLICABLE, Y
COMPRIS NOTAMMENT TOUTE GARANTIE IMPLICITE RELATIVE A LA QUALITE MARCHANDE, A L'APTITUDE A UNE
UTILISATION PARTICULIERE OU A L'ABSENCE DE CONTREFACON.
We welcome your feedback. Use the OpinionLab [+] feedback system on the documentation Web site or Send your comments to:
Sun Learning Services
Sun Microsystems, Inc.
500 Eldorado Blvd.
Mailstop: UBRM06-307
Broomfield, CO 80021-6307
USA
Please include the publication name, part number, and edition number in your correspondence if they are available.
This will expedite our response.
Please
Recycle

316196601 • Revision: A iii
Contents
Preface v
Organization v
Related Information v
Additional Information vi
1. Introduction 1
Drive Tray 2
Specifications 3
Compatibility 5
Order Numbers 6
2. Dione Card 7
Firmware Requirements 7
Dione Card Components 8
Connecting to the Dione Card 9
KMS Operations 10
Key Lifecycle 10
Media RFID Chips 12
Media Types 12
Removal and Replacement 14
Removal 14
3. Virtual Operator Panel 17
VOP Prerequisites 18
Computer Hardware Requirements 18
Operating System Certification 18
Java Runtime Environment Requirement 18

iv KMS: LTO4 Technical Brief • June 2008 Revision: A • 316196601
Using VOP 19
Start VOP 20
Diagnose Drive Tab 23
Run LED Diagnostic Test 23
Run Loopback Test 24
Get Log 25
Load Firmware 25

316196601 • Revision: A v
Preface
This technical brief is intended for Sun StorageTekTM representatives, customers,
and anyone responsible for planning the installation of the Crypto Key
Management System (KMS) encryption solution.
Organization
Related Information
These publications contain the additional information:
This guide has the following organization:
Chapter Use this chapter to:
Chapter 1, “Introduction”
Chapter 2, “Dione Card”
Chapter 3, “Virtual Operator Panel”
Publication Description Part Number
Crypto Key Management System Systems Assurance Guide StorageTek: 31619480x
Crypto Key Management System Installation and Service Manual StorageTek: 31619490x
Crypto Key Management System Administrator Guide StorageTek: 31619510x

Preface
vi KMS: LTO4 Technical Brief • June 2008 Revision:A • 316196601
Additional Information
Sun Microsystems, Inc. (Sun) offers several methods to obtain additional
information.
Sun’s External Web Site
Sun’s external Web site provides marketing, product, event, corporate, and service
information. The external Web site is accessible to anyone with a Web browser and
an Internet connection.
The URL for the external Web site is: http://www.sun.com
The URL for StorageTek™ brand-specific information is:
http://www.sun.com/storagetek/
Documentation and Download Web Sites
Web sites that enable customers, members, and employees to search for technical
documentation, downloads, patches, features, and articles include:
■Documentation: http://docs.sun.com/app/docs (customers)
■Internal access: http://docs.sfbay.sun.com/app/docs (internal)
■Sun Download Center: http://www.sun.com/download/index.jsp (customers)
■Sun Partner Exchange: https://spe.sun.com/spx/control/Login (partners)
■Uniform Software Repository: http://dlrequest.sfbay.sun.com:88/usr/login
(internal)
If your customer does not already have a Sun Online Account they will need to
register. For a new account, go to: https://reg.sun.com/register
For more information about Sun StorageTek products, got to:
http://sunsolve.sun.com/handbook_pub/validateUser.do?target=STK/STK_index
Partners Site
The Sun StorageTek Partners site is a Web site for partners with a StorageTek
Partner Agreement. This site provides information about products, services,
customer support, upcoming events, training programs, and sales tools to support
StorageTek Partners. Access to this site, beyond the Partners Login page, is
restricted. On the Partners Login page, employees and current partners who do
not have access can request a login ID and password and prospective partners can
apply to become StorageTek resellers.
The URL for partners with a Sun Partner Agreement is:
http://www.sun.com/partners/

316196601 • Revision: A 1
CHAPTER 1
Introduction
Overview The Hewlett Packard (HP) LTO4 is the fourth-generation of Ultrium, Linear
Tape-Open tape drives. This generation offers more capacity and increased
performance than earlier versions of LTO tape drives.
Encryption
Capable
The Hewlett Packard LTO4 is the first, non-StorageTek T-Series tape drive to
support the Crypto Key Management System Version 2.0.
This encryption-capability requires a special, custom designed, Ethernet
card—called the Dione card—that enables the LTO4 drive to connect to and
interface with the Key Management System (KMS) network.
With this connection, the LTO4 is capable of communicating with the KMS
to transfer encryption keys over the secure network.
Note: The HP LTO4 can only use one encryption key at a time. During a read
operation, if another encryption key is found, the Dione card requests the
key directly from the KMS.
Media
(Native capacity)
The HP LTO4 drive with LTO4 media can store up to 800 GB of data.
This drive can also read and write on LTO3 media (400 GB), and provides
read-only capabilities with LTO2 media (200 GB).
The LTO4 tape drive also supports Write Once, Read Many (WORM) secure
media. This non-erasable, non-rewritable media meets several compliance
regulations such as HIPAA, Sarbanes-Oxley, and SEC 17A-4.
Note: Encryption is only possible using LTO4 media, including LTO4
WORM media, with the HP LTO4 tape drive. If you insert LTO2 or LTO3
media, encryption will be disabled.
Interfaces
(Native rates)
The HP LTO4 drive supports up to 120 MB/s data transfer rates using Data
Rate Matching (DRM). This features allows the tape drive to dynamically
and continuously adjust the speed of the drive, from 40 to 120 MB/s for
maximum performance
Interface support for the HP LTO4 includes:
■Ultra 320 Small Computer System Interface (SCSI)
■4 Giga-bits per second (Gbps) Fibre Channel

Drive Tray
2 KMS: LTO4 Technical Brief • June 2008 Revision: A • 316196601
Installing this tape drive in one of Sun StorageTek’s automated tape configurations
offers customers with an even wider choice of tape-based storage solutions.
■Server compatibility: Fibre Channel and SCSI models on popular (qualified)
platforms from vendors such as Sun, HP, IBM, and Dell.
■Software compatibility: Support for an extensive list of software applications
such as ACSLS, HP, CA, VERITAS, Legato, Tivoli, and many more.
■Support for WORM media: Allows for unalterable backups using Write-Once
Read-Many (WORM) media to meet compliance regulations such as HIPAA,
Sarbanes-Oxley, SEC 17A-4.
■Mid-range class: Delivers confidence with a wide variety of supported backup
applications.
Drive Tray
FIGURE 1-1 shows an example of an LTO4 tape drive mounted in a drive tray.
FIGURE 1-1 LTO4 Tape Drive in Drive Tray—SL8500
1. “PWR” = power indicator (green)
2. “FAULT” = Fault indicator (red)
3. “MAINT” = Recessed button that resets the
Dione card
4. The green LED is ON during the Dione card IPL
and when an encryption/decryption key is
present during drive operation
5. “PORT A” = Fibre Channel interface port
6. “PORT B” = Not used
7. RJ-45 connector. This port is auto sensing to 10
Mbps/100 Mbps data rates and used to:
■Configure the network
■Enroll the agent on the KMS
■Retrieve the diagnostic log file
■Upgrade Dione card firmware
1
2
3567 4

316196601 • Revision: A Chapter 1 Introduction 3
Specifications
Specifications
TABLE 1-1 provides a comparison of tape drive specifications.
TABLE 1-1 Tape Drive Specifications
LTO2 LTO3 LTO4
Physical Specifications
Height 8.25 cm (3.25 in.) 8.25 cm (3.25 in.) 8.25 cm (3.25 in.)
Width 14.6 cm (5.75 in.) 14.6 cm (5.75 in.) 14.6 cm (5.75 in.)
Length (depth) 21.38 cm (8.4 in.) 21.38 cm (8.4 in.) 21.38 cm (8.4 in.)
Weight 2.1 kg (4.6 lb) 2.24 kg (4.94 lb) 2.24 kg (4.94 lb)
Performance Specifications
Capacity (native) 200 GB 400 GB 800 GB
Transfer rate (native) 30 MB/s 80 MB/s 120 MB/s
Streaming range (native) 13.7 to 35.6 MB/s 27 to 80 MB/s 40 to 120 MB/s
Data Buffer size 64 MB 128 MB 128 MB
Number of tracks 512 704 896
Load to ready * 15–24 sec 19 sec 19 sec
Access time-average (to first file) 64–75 sec 72 sec 62 sec
Tape speed (meters per second) 5.50 m/s 5.32 m/s 7.0 m/s
Tape read/write speed 6.20 m/s 5.32 m/s 6.20 m/s
Rewind time (maximum/average) 104/52 sec 98/49 sec 124 sec
Unload time 13–19 sec 19 sec 19 sec
Cleaning time 58 to 152 sec
Interface Support (SCSI)
(Fibre Channel)
Ultra3 SCSI (LVD)
FC1
Ultra-320 (LVD)
FC2
Ultra-320 (LVD)
FC4
MTBF (100% duty cycle) 250,000 hrs 250,000 hrs 250,000 hrs
Media/Format Compatibility
Read LTO1, LTO2 LTO 1, 2, 3 LTO 2, 3, 4
Write LTO1, LTO2 LTO2, LTO3 LTO3, LTO4
Note: HP drives support the LTO standard for backward compatibility, which is to write back
one generation and read back two generations.
Power
Consumption 38 W 35 W 30 W
Interface Codes:
Fibre Channel: FC1 = Fibre Channel 1Gb, FC2 = Fibre Channel 2Gb, FC4 = Fibre Channel 4Gb
Note: * Encryption-capable and un-initialized WORM cartridges can take longer to load.

Specifications
4 KMS: LTO4 Technical Brief • June 2008 Revision: A • 316196601
TABLE 1-2 provides a comparison of media specifications.
TABLE 1-3 lists the reliability specifications.
TABLE 1-2 Media Specifications
Specification LTO 2 LTO 3 LTO 4
Tape Base film PEN (Poly-Ethylene-Naphthalate)
Tape length 609m 680m 820m
Tape length used for data 580m 648m 783m
Tape width 12.65 mm 12.65 mm 12.65 mm
Tape dimensional stability 1200 ppm 1200 ppm 900 ppm
Maximum tape speed 7.29 m/s
Rewind speed 7.00 m/s
Durability 1,000,000 passes
Cartridge Width 105.4±0.30 mm
Depth 102.0±0.30 mm
Height 21.5±0.25 mm
Weight 0.220 kg
Track density (TPI) 1260 1773 2212
Data tracks 512 704 896
Data channels 8 16 16
Number of wraps 64 44 56
Number of bands 4 4 4
Bit density 7.40 Kb/mm 9.64 Kb/mm 13.52 Kb/mm
Cartridge memory capacity 4096 bytes 4096 bytes 8192 bytes
TABLE 1-3 Reliability Specifications
Description Specification
MTBF (100% duty cycle) 250,000 hours
Load/unload life 100,000 swaps
Head life 60,000 hours
Media durability 1,000,000 passes
Maximum cartridge use 20,000 threads

316196601 • Revision: A Chapter 1 Introduction 5
Specifications
Compatibility
HP LTO Ultrium 4 drives are specified to interchange with un-encrypted data
cartridges from other tape drives that comply to the LTO U-28, U-316 and U-416
specifications:
Future compatibility:
In the future, HP LTO Ultrium drives will be capable of:
■Reading and writing tapes from the current generation
■Reading and writing tapes from one earlier generation
■Reading tapes from two earlier generations
HP LTO Ultrium drives will always maintain write and read compatibility with
other manufacturers’ LTO Ultrium drives and tapes that meet the LTO Ultrium
format specification.
Note – Currently, only LTO4 media is encryption-capable on the LTO4 tape drives.
While LTO4 can read and “write” to LTO3 media, if an LTO4 drive encrypted data
on LTO3 media, then LTO3 drives could not read those tapes. Therefore, when
LTO3 media is inserted into an LTO4 drive, the encryption capability is disabled
and the drive will write non-encrypted data without notification.
TABLE 1-4 LTO Media Compatibility
Native Capacity (Length) Format
Capability
Write Read
800 GB WORM LTO4 Yes Yes
800 GB (820m) LTO4 Yes Yes
400 GB WORM LTO3 Yes Yes
400 GB (680m) LTO3 Yes Yes
200 GB (580m) LTO2 No Yes
100 GB (580m) LTO1 No No
50 GB (290m) LTO1 No No

Order Numbers
6 KMS: LTO4 Technical Brief • June 2008 Revision: A • 316196601
Order Numbers
License Keys
Configured End Items
X-Options (Conversion Bills)
Dione Card
FIGURE 1-2 License Keys
LTO4 Encryption Key Marketing Number Description
Bundled X-HP-LTO4-EKEY-B One required per encryption enabled drive.
Bundled with the drive at time of sale.
After market X-HP-LTO4-EKEY-A One required per encryption enabled drive.
After market for drives previously purchased.
TABLE 1-5 Configured End Items—Order Numbers
Part Numbers Description
SL500
LTO4E-HP4FC-SL500Z LTO4 HP FC 4Gb SL500 Encryp Dr
LTO4E-HPSC-SL500Z LTO4 HP SCSI SL500 Encryp Dr
SL8500
LTO4E-HP4FC-SL85Z LTO4 HP FC 4Gb SL8500 EncrypDr
SL3000
LTO4E-HP4FC-SL30Z LTO4 HP FC 4Gb SL3000 EncrypDr
TABLE 1-6 Conversion Bill Numbers
Part Numbers Description
SL500
XHPLTO4E-FCUPL500Z Crypto drive upgrade for HP LTO4 FC SL500
XHPLTO4E-SCUP500Z Crypto drive upgrade for HP LTO4 SCSI SL500
SL3000/8500
XHPLTO4E-FCUP3085Z Crypto drive upgrade for HP LTO4 FC SL3000/SL8500
TABLE 1-7 Dione Card Part Number
Part Number Description
419954901 HP LTO4 Dione Card

316196601 • Revision: A 7
CHAPTER 2
Dione Card
The Dione card—pronounced (D - O - nee)—is a custom design that provides an
Ethernet interface for the HP LTO4 tape drive. With this interface, the HP LTO4
tape drive can:
■Encrypt and decrypt data using the Sun StorageTek Crypto Key Management
System (KMS), Version 2.0 and above
■Configure and enroll the tape drive using the Virtual Operator Panel (VOP),
Version 1.0.12 or higher
Basically, the Dione card is a translation device between the serial interface on the
tape drive and the secure Ethernet port for use with the KMS.
The Dione card includes:
■Telnet server for configuration and management
■FTP server for installing new firmware and retrieving firmware trace logs
■SOAP client (with TLS 1.0 support) for communication with the KMS
Firmware Requirements
The minimum firmware requirements include:
TABLE 2-1 Firmware Requirements
Component Version (or above)
Dione card 1.178
HP LTO4 tape drive H45S Fibre Channel
B44S SCSI
KMS Version 2.0 2.02
ACSLS 7.1 and 7.1.1 with PUT0701, or 7.2, and 7.3
SL8500 library 3.98B
SL3000 library 2.01 (SPS)—Requires approval
SL500 library i15 — 1300 (SPS)—Requires approval
L-Series 3.18.xx
Virtual Operator Panel 1.0.12

Dione Card Components
8 KMS: LTO4 Technical Brief • June 2008 Revision:A • 316196601
Dione Card Components
The Dione card installs in the open area of the drive trays behind the tape drives.
Library drive trays that support this card are the:
■SL8500
■SL3000
■SL500
■L-Series
Each drive tray has its own unique configuration depending on the space in the
open area of the drive tray.
FIGURE 2-1 shows an example of a Dione card, which consists of:
■Dione card
■Ethernet connector (RJ-45)
■Power connection (inline with the tape drive power)
■Communications connection to the tape drive
■Reset switch (on the drive tray rear panel)
■Green Status LED (on the drive tray rear panel)
FIGURE 2-1 Dione Card Components
1. Dione card
2. Ethernet connection (RJ-45)
3. Reset switch
4. Green status LED
5. LED connection (2 wires)
6. Inline power connection
7. Tape drive power connection
8. Tape drive communications connection
9. Reset switch connection (2 wires)

316196601 • Revision: A Chapter 2 Dione Card 9
Dione Card Components
Connecting to the Dione Card
FIGURE 2-2 shows two ways to connect to the Dione card:
■Point-to-point using a crossover cable
■Network using a switch or hub and standard (straight-through) Ethernet cables
Note – The default IP address of the Dione card is 10.0.0.1.
This address is the same as the T-Series tape drives.
Because of this, the initial connection to the Dione card and LTO4 tape drive
should be with a crossover cable to set a new IP address. Then once the IP address
is set, you can connect the drive to the network for configuration and enrollment.
See Chapter 3, “Virtual Operator Panel” for information.
Green LED operation:
When you power-on the LTO4 tape drive, the green LED lights for 30 seconds as
the Dione card performs an initial program load (IPL).
■If the LED does not come on when power is applied (and there is power on the
tape drive) there is a problem with the Dione card.
■If this LED does not go out after 30 seconds (approximately), there is a problem
with the Dione card.
After 30 seconds, the LED goes out and stays out until the tape drive is in an
encryption-capable mode (tape loaded, key available, encrypting or decrypting).
Reset Switch operation:
The reset switch performs one of three functions:
1. In normal operation, pressing this button resets the Dione as if at power-on.
2. Pressing and holding for more than 3 to 4 seconds resets all the stored settings to
their manufacturing defaults, and then resets the Dione as if at power-on.
3. When Running the LED Test it temporarily changes the mode of operation
allowing you to press the switch causing the LED to flash. The flashing stops
when the switch is released.
FIGURE 2-2 Connecting to the Dione Card
Point-to-Point: Crossover Cable Connection Network: Standard Ethernet Connection

KMS Operations
10 KMS: LTO4 Technical Brief • June 2008 Revision:A • 316196601
KMS Operations
When the tape drive is powered-on, the Dione card communicates to the drive
over the serial port to take control of drive encryption and decryption.
HP LTO4 tape drives have the capability of storing one (1) key while encrypting or
decrypting data. Therefore; it is essential that these drives stay connected to the
KMS network for communications. Failover and load balancing will also occur
between the KMAs in the system (KMS).
The following is a brief description about how the drive implements encryption:
■During write operations, when the backup application starts writing, the Write
command triggers the drive to request an encryption key from the Dione card.
The Dione creates a secure connection to the KMA and requests a key.
The KMA provides the key.
The Dione card unwraps the key and sends it to the drive, which continues with
the write operation.
■During read operations, a similar set of operations occur.
The backup application sends a read request.
The drive recognizes that the data is encrypted and requests a decryption key
from the Dione card.
Note: The LTO4 tape format stores the metadata (key) along with encrypted
data. This gives the Dione card a method to retrieve the required key for
decryption.
The Dione card verifies the Key Associated Data in the data block to determine
the Key ID for that block and requests the corresponding key from the KMA.
Once the key has been received, it is sent to the drive and the read proceeds.
■During media loads and unloads the Dione card monitors tape drive and
fetches the appropriate Data Unit (for loads) or clearing of the encryption status
(for unloads).
Key Lifecycle
Keys undergo a lifecycle based on the key policy. The lifecycle imposed by the
KMS is based on the NIST 800-57 guidelines and has two time periods:
■Encryption period the time after a key is assigned that it can be used to encrypt.
■Cryptoperiod the time period it can be used for decryption.
It is assumed the two periods start at the same time when the key is assigned.
FIGURE 2-3 shows an example of how these periods interacts.

316196601 • Revision: A Chapter 2 Dione Card 11
KMS Operations
A potential issue:
That LTO4 drive firmware will not request a write key in the following scenario:
Read, Space, Write-Filemark, Write.
The drive will use the same key obtained for the Read command to encrypt the
data provided for the Write command. The state of this key may be inappropriate
for writing due to the policy associated with the drive (an expired key).
Work-Around:
Assign the drive’s Key Group having a key policy with a long encryption period.
An encryption period of a year or longer is recommended.
Details:
The LTO-4 drive firmware will not request a write key in the following scenario:
Read, Space, Write-Filemark, Write. The drive will use the key obtained from the
Read command to encrypt the data provided for the Write command.
Most applications go through this sequence of operations when
appending data to a tape.
The end result is that encryption keys previously used on that tape will continue to
be used for write operations even if the state of the key has changed to expired or
compromised.
The encryption period is a user defined policy.
An encryption period of a year or longer is recommended to mitigate the risk of
write operations using an expired key. Most applications write sequentially to a
tape cartridge until it is full. It is rare that a customer would not fill a tape
cartridge with data within a year.
This is a low impact issue due to ability to mitigate exposure with a user defined
encryption period and due to the non-disruptive nature of the error. Data
encrypted with an expired key can still be accessed normally on future attempts to
append or restore.
It is recommended that the customer not destroy encryption keys as a means to
enforce data life-cycle management. Instead, enforce data life-cycle management
by expiring volumes through the backup and archive applications.
FIGURE 2-3 Key Lifecycle

KMS Operations
12 KMS: LTO4 Technical Brief • June 2008 Revision:A • 316196601
At release, the functionality to set a key in a compromised state is not present.
This is a low impact issue due to the system assigning unique encryption keys for
each tape cartridge. It is rare that a compromised key scenario would ever be
encountered. If it was it would only impact future writes to a single tape cartridge.
This functionality will be implemented in the next drive firmware update.
Media RFID Chips
Use FIGURE 2-4 to connect the bulleted terms with the KMS Manager.
New data cartridges may not have the physical barcode information written to the
Radio Frequency Identification (RFID)1chip—also know as the cartridge
memory—in the LTO4 cartridge during the initial mount (load).
This requires updated library firmware, and not all libraries support this function.
Future updates to library firmware will correct this problem allowing the cartridge
memory to write the physical barcode. Libraries include:
■SL8500 = supported (3.98B and above)
■SL3000 = supported (2.01 and above)
■SL500 = supported (i15)
■L-Series = requires an update (3.18.xx)
The barcode information from the cartridge memory is passed to the KMS and
stored as additional metadata for a Data Unit (cartridge).
The External Tag field of the Data Unit contains the physical barcode information
when the library firmware update is available.
Refer to the Crypto KMS Administration Guide for more information about Data
Units and the ExternalTag field.
Note – When installing the HP LTO4 tape drive in an SL500 library, you must
disable the “Fast Load” option. Disabling this option allows the library and tape
drive to update the RFID chip with the physical barcode information.
This is not necessary for the SL3000 and SL8500 libraries.
Media Types
Important:
Encryption is only possible on LTO4 media, including LTO4 WORM media.
If an earlier media-type (such as an LTO3 data cartridge) is found in the drive,
encryption is disabled until that media is unloaded.
When fetching the Data Unit from the KMA, the Dione card sets the:
■Description field to either “LTO4” or “LTO4WORM”
■External Tag field if the library stored a barcode label in the Cartridge Memory
■External Unique ID is the (vendor-unique) Cartridge Memory Attribute
1. Radio Frequency Identification (RFID) chips are also called cartridge memory chips.
The RFID chip contains information about the cartridge, the tape, and the performance
over time. This non-volatile storage information includes:
• Manufacturing information • Initialization information
• Usage • Tape directory
• Pass history • Error history
• Tape Alert flags • Status of the MIR
1
2
3
4