Implementing Data Encryption

[deany]

Colleagues,

Environment:
AIX V5.3.0
TSM V5.3.2 (server and clients)
TSM V5.3.2 (Windows Server 2003 clients)

Question 1:

We are investigating client side data encryption (AES 128 bit).
How do I define the initial clear text key? What are the limitations
for selecting a proper key?

1 - 128 bits = 128/8 = 16 bytes = 16 characters long

2 - Can I have the initial key string be:

asdf3hjk6zxcv5nm (note: only 16 characters, only alpha numerics
and no spaces)

or

My key is this ? (note: only 16 characters, there are
spaces and none alpha numeric values)

or

asdfa9asdfasf2dfasdfasdf (note: there are more than 16
characters, alpha numerics

Which one(s) are valid?


Question 2:

We have (1) TSM server and one domain for a Production Peoplesoft
environment. Since we are new to TSM and data encryption we would
like to try implementing encryption with development data rather than
production data.

So, after I create a second, separate domain in TSM for the development
environment, I want to test the encryption feature.
My concern it that the development data is an exact copy of the production data. Is it possible to test encryption only with the test version of the data and not effect the production version with only one TSM server, but 2 different domains?

If so, what steps do I have to do in order to make this happen?


Thank - you ..... DeanY

 

[denisl]

As far as key format goes I'm not sure - give it a try but I think your key can be less the 16 characters. I played with this a while back and I tested using the node name as the key and it worked.

As far as mixing prod and test data on the same TSM server.. that's not an issue. You don't even need a seperate domain. Your test node data is completely independant of any other node including the production node.

 

[deany]

Denisl,

Thank-you for your prompt reply.

I need an additional clarification to my second question about testing the encryption feature. We take a data dump of the production (production has no encryption at this time) and refresh the development environment. Therefore the data is exactly the same including the naming of the files and directories. Won't the same names of the files and directories confuse TSM?

Do you still hold to your original response to question 2?

Thanks again ... DeanY