Using CA Tape Encryption in Your z/OS Environment › How CA Tape Encryption for CA Disk Works

How CA Tape Encryption for CA Disk Works

For sites using CA Tape Encryption for CA Disk, you must apply maintenance to CA Disk to activate the encryption of archive tapes. With this maintenance installed you can encrypt and decrypt all archive tapes, copies of these tapes or both primary and duplex copies of archive tapes. CA Tape Encryption for CA Disk uses the in-house tape format with symmetric keys saved in either the ICSF CKDS or the BES database, as selected by the user.

Activating the encryption of CA Disk archive tapes requires you to do the following:

• Specify the BTEITAPE and BTEDATCL sysparms in your CA-Disk system.
• Note: For more information about the BTEDATCL and BTEITAPE sysparms and the utilities supporting integration between CA Tape Encryption and CA Disk, see the CA Disk Backup and Restore Systems Guide.
• Create or update the SMS Data Class identified by the CA Disk BTEDATCL system parameter and ensure its description field conforms to the CA Tape Encryption standards.
  • The data class description must be updated to include the BES=(key_name) parameter which identifies the key and its encryption algorithm to use when encrypting CA-Disk archive tapes.
  • The need to decrypt a CA-Disk archive tape is automatically detected and the appropriate decryption routine is activated during read processing.

Note: To create B2B tapes you must license CA Tape Encryption Option for CA 1, CA Tape Encryption Option for CA TLMS, or the CA Tape Encryption Option for Third Party TMS.