CA Tape Encryption Installation and Configuration Best Practices › Configuration for Optimal Performance › Encryption Algorithm Selection

Encryption Algorithm Selection

Select the strongest hardware-based algorithm available on your system.

Business Value:

Selecting a strong algorithm implemented in hardware with a larger key gives you the best combination of faster processing while securing the encrypted data for a longer period of time.

Additional Considerations:

CA Tape Encryption supports the DES, triple DES, and AES algorithms:

• DES64
• 3DES128
• 3DES192
• AES128
• AES192
• AES256

Hardware algorithms perform quicker than their software equivalents. With the exception of DES64, these algorithms are all FIPS-compliant. The DES and triple DES algorithms are implemented in hardware in CCF and CPACF, and AES128 is implemented in hardware on the z9. The z10 provides hardware implementations of AES192 and AES256.

Consider your DR processing when selecting the algorithm. CA Tape Encryption provides software versions of the AES128, AES192, and AES256 algorithms that can be used to recover tapes at a DR site if the algorithms are not available in hardware.