CA Tape Encryption Installation and Configuration Best Practices › Configuration for Optimal Performance › Database Selection

Database Selection

Use the CA Tape Encryption database (BES database) as your key repository unless your company has specific security and cryptography requirements.

Business Value:

CA Tape Encryption with a BES database key repository is faster and easier to recover at DR than CA Tape Encryption with a Cryptographic Key Data Set (CKDS) key repository. Choosing the BES database saves your business time and money because you can start application processing at DR more quickly.

Additional Considerations:

Symmetric keys generated by CA Tape Encryption are saved in one of the following:

• The BES database
• The CKDS database

The parmlib attribute KeysDatabase= specifies the database used.

If you choose to save keys in the CKDS database:

• The keys are prevented from leaving the secure hardware environment provided by a FIPS 140-2 certified IBM PCI cryptographic coprocessor card.
• The ICSF component must be installed and configured to allow CA Tape Encryption to request that ICSF create keys in the trusted hardware.
• You must recover the ICSF application and the CKDS using the utilities and procedures provided by IBM to run your applications at DR.
• You must recover the BES database to run at DR.

More Information:

For information on secure key processing requirements, see the Administration Guide.