HP Lto 5 Manual

							01234567
DataEncryptionStatusPageCode(0020h)14
15
NextBlockEncryptionStatusPageCode(0021h)16
17
TapeDataEncryptionOutSupportpage
01234567
PageCode(0001h)0
1
PageLength(02h)2
3
TapeDataEncryptionInSupportPageCode(0010h)4
5
DataEncryptionCapabilitiespage
01234567
PageCode(0010h)0
1
PageLength(28h)2
3
CFG_PEXTDECC(10b)Reserved(0)4
Reserved(0)5
19
AlgorithmIndex(01h)20
Reserved(0)21
DescriptorLength(0014h)22
23
Encrypt_CDecrypt_CDED_C(1)MAC_C(1)SDK_C(0)AVFMV24
AKADF(0)UKADF(0)VCELB_C(1)Resvd(0)Nonce_C(1)AVFCLP25
MaximumUnauthenticatedKey-AssociatedDataBytes(20h)26
27
MaximumAuthenticatedKey-AssociatedDataBytes28
29
KeySize(0020h)30
31
EAREM(1)RDMC_C(4)Reserved(0)32
SECURITYPROTOCOLINA2h201 
						

							01234567
Reserved(0)33
39
EncryptionAlgorithmIdentifier(AES-CGM)(00010014h)40
43
Thedeviceisexternaldataencryptioncapable.10bEXTDECC
ConfigurationPreventedCFG_P
Dataencryptionparameterscanbeestablishedorchanged.01b
Dataencryptionparameterscannotbeestablishedorchanged.10b
AlgorithmValidForMountedVolume.Setto1ifthereisatapethreadedanditisencryption-capable
usingthesuppliedalgorithmindex.
AVFMV
Thedevicecandecryptdatausingthisalgorithminhardware.10bDecrypt_C
Thedevicecandecryptdatausingthisalgorithmbutcontrolofthedataencryptionparameters
isprevented.
11b
Thedevicecanencryptdatausingthisalgorithminhardware.10bEncrypt_C
Thedevicecanencryptdatausingthisalgorithmbutcontrolofthedataencryptionparameters
isprevented.
11b
AlgorithmValidForCurrentLogicalPositionAVFCLP
Notapeloaded.00b
Thespecifiedencryptionalgorithmisnotvalidforwritingatthecurrentlogicalposition.01b
Thespecifiedencryptionalgorithmisvalidforwritingatthecurrentlogicalposition.10b
AGeneration4tapeismountedinthedrive.0ChMaximum
Authenticated
Key-Associated
DataBytes
Otherwise.3Ch
TheRAWDecryptionModeControlCapabilitiesfieldissetto04htoindicatethat:
•PerformingreadoperationsinRAWdecryptionmodeisnotallowedbydefault.
•TheapplicationmaycontrolfutureRAWreadsviatheRDMCfieldinthe“SetDataEncryptionpage”
(page206).
RDMC_C
TheEncryptionAlgorithmRecordsEncryptionModebitissettooneiftheencryptionmodeisrecorded
witheachencryptedblock.
EAREM
SupportedKeyFormatspage
01234567
PageCode(0011h)0
1
PageLength(01h)2
3
KeyFormat(00h)4
Seethe“SetDataEncryptionpage”(page206)oftheSECURITYPROTOCOLOUTcommandfor
adescriptionofKeyFormatof00h.
202Commands 
						

							DataEncryptionManagementCapabilitiespage
01234567
PageCode(0012h)0
1
PageLength(0Ch)2
3
LOCK_C(1)Reserved(0)4
CKORL_C(1)CKORP_(1)CKOD_C(1)Reserved(0)5
Reserved(0)6
Public_C(1)Local_C(1)AITN_C(1)Reserved(0)7
Reserved(0)8
15
DataEncryptionStatuspage
01234567
PageCode(0020h)0
1
PageLength(n−3)2
3
KeyScopeReserved(0)I_TNexusScope4
EncryptionMode5
DecryptionMode6
AlgorithmIndex(01h)7
KeyInstanceCounter8
11
RDMDCEEMSVCELBParametersControlRsvd(0)12
Reserved(0)13
23
Key-AssociatedDataDescriptorsList24
n
ThisfieldisrelativetothekeyindicatedbytheKeyScopefieldvalue.Onekeyinstancecounteriskept
foreachkeythedeviceserverismanaging.Itisclearedtozeroonlyafterapower-oncondition.Any
eventthatsets,clearsorchangesoneoftheparametersinasetofsecurityparameterswillincrement
thisvalue.Thecountercanrollover.
KeyInstance
Counter
Dataencryptionparametersarenotexclusivelycontrolledbyexternaldataencryption
control.
001bParameters
Control
DataencryptionparametersareexclusivelycontrolledbytheSSCdeviceserver.010b
DataencryptionparametersareexclusivelycontrolledbytheADCdeviceserver.011b
SECURITYPROTOCOLINA2h203 
						

							Dataencryptionparametersareexclusivelycontrolledbyamanagementinterface.100b
TheVolumeContainsEncryptedMogicalBlocksfieldissettoonewhenatapeisloadedandcontains
atleastoneencryptedlogicalblock.Otherwisesettozero.
VCELB
TheCheckExternalEncryptionModeStatusfieldcontainsthevaluefromthecheckexternalencryption
modeparametervaluesavedfortheI_Tnexusonwhichthecommandwasreceived.
CEEMS
TheRAWDecryptionModeDisabledbitissettooneifthedriveisconfiguredtomarkeachencrypted
blockasdisabledforRAWreadoperationsbasedontheRAWdecryptionmodedisableparameter
valuesavedfortheI_Tnexusonwhichthecommandwasreceived.
RDMD
NextBlockEncryptionStatuspage
ThispagewillperformMediaAccessChecks.
01234567
PageCode(0021h)0
1
PageLength(n−3)2
3
BlockNumber4
11
EncryptionStatusCompressionStatus12
AlgorithmIndex(01h)13
RDMDSEMESReserved(0)14
Reserved(0)15
Key-AssociatedDataDescriptorsList16
n
Only0hissupported.CompressionStatus
Unabletodetermineiftheblockiscompressed.0h
Only01h,03h,05hand06haresupported.EncryptionStatus
Capableofdeterminingiftheblockisencrypted,butnotatthistime(becauseofEOD,
readerror,orsimilar).
01h
Theblockisnotencrypted.03h
Theblockisencryptedbyasupportedencryptionalgorithm.KADdescriptorsare
returned.
05h
Theblockisencryptedbyasupportedencryptionalgorithm,butthedrivecannotdecrypt
theblock,ordoesnothavethecorrectkeyornoncevalue.
06h
TheEncryptionModeExternalStatusbitissettooneiftheEncryptionStatusfieldissettoeither
5hor6h,andthenextblockismarkedashavingbeenwrittentothemediumwhiletheencryption
modewassettoEXTERNAL.Itissettozerootherwise.
EMES
TheRAWDecryptionModeDisabledStatusbitissettooneiftheEncryptionStatusfieldisset
toeither5hor6h,andthenextblockismarkedasdisabledforRAWdecryptionmodeoperations.
Itissettozerootherwise.
RDMDS
204Commands 
						

							SECURITYPROTOCOLOUTB5h
TheSECURITYPROTOCOLOUTcommandisusedtoconfigurethedatasecurityparametersfor
theI_Tnexusinthedeviceserverandonthetape.
Pre-executionchecks
UnitAttentionDeferredErrorReservationIllegalField
Commanddescriptorblock
01234567
OperationCode(B5h)0
SecurityProtocol1
SecurityProtocolSpecific2
3
Reserved(0)Inc_512(0)4
Reserved(0)5
AllocationLength6
9
Reserved(0)10
Control11
CDBfields
TapeDataEncryptionsecurityprotocol20hSecurityProtocol
ThecontentsofthisfielddependontheprotocolspecifiedbytheSecurityProtocolfield.See
below.
SecurityProtocol
Specific
ThenumberofbytesallocatedforthereturnedparameterdataAllocationLength
SECURITYPROTOCOLOUTreturneddata
TapeDataEncryptionsecurityprotocolinformation
WhentheSecurityProtocolfieldis20h,onlytheSetDataEncryptionpage(0010h)issupported,
whichmustbespecifiedintheSecurityProtocolSpecificfield.
SECURITYPROTOCOLOUTB5h205 
						

							NOTE:EncryptionisonlyperformedonLTO-4andLTO-5tapes.Onothertapes,anattemptto
writewhenencryptionisenabledorreadwhendecryption(orRAWmode)isenabledwillterminate
withCHECKCONDITIONstatus,withsenseofDATAPROTECTandadditionalsenseof3000h
(incompatiblemediuminstalled).AttemptstoenableencryptionordecryptionwhenotherLTO
formattapesareloadedwillterminatewithCHECKCONDITIONstatus,withsenseofILLEGAL
REQUESTandadditionalsenseof2600h(invalidfieldinparameterlist).
SetDataEncryptionpage
01234567
PageCode(0010h)0
1
PageLength(n−3)2
3
LockReserved(0)Scope4
CKORLCKORPCKODSDK(0)RDMC[0]CEEM[0]5
EncryptionMode6
DecryptionMode7
AlgorithmIndex(01h)8
KeyFormat(00h)9
Reserved(0)10
17
KeyLength(20h)18
19
Key20
51
Key-AssociatedDataDescriptorsList52
n
AllfieldsintheSetDataEncryptionpageotherthanScopeandLock
fieldsareignored.TheI_Tnexuswilluseshareddataencryption
parameters.IfnoI_Tnexusesaresharingdataencryptionparameters,
thedrivewillusethedefaultparameters.
Public0hScope
DataEncryptionparametersarenotshared,butareuniquetothisI_T
nexus.
Local1h
DataencryptionparameterswillbesharedwithallI_Tnexuseswhose
scopeisPublic.
AllI_T
Nexus
2h
TheI_Tnexuswillbeassociated(andlocked)tothesetofdataencryptionparameters
establishedafterprocessingtheSECURITYPROTOCOLOUTcommand,andthecurrent
KeyInstanceCounter.Thebitcanonlybeclearedthroughahardresetoranother
SECURITYPROTOCOLOUTfromthesameI_Tnexus.
1Lock
CheckExternalEncryptionMode.Ifthisfieldissettoeither10bor11b,andthedecryption
modeissettoDISABLE,SECURITYPROTOCOLOUTisterminatedwithCHECKCONDITION,
withadditionsenseofsetto2600h(invalidfieldinparameterlist).
CEEM
Sameas10b.00b
206Commands 
						

							Donotchecktheencryptionmodeusedtowritetheblock.01b
Onreadandverifycommands,checktheencryptionmodeusedtowritetheblock.
DecryptionModeissettoDECRYPTorMIXED.Reportanerroriftheblockwaswritten
inEXTERNALmode.ThesensekeyissettoDATAPROTECTwithadditionalsenseof
7409h(encryptionmodemismatchonread).
10b
Onreadandverifycommands,checktheencryptionmodeusedtowritetheblock.
DecryptionModeissettoDECRYPTorMIXED.Reportanerroriftheblockwaswritten
inENCRYPTmode.ThesensekeyissettoDATAPROTECTwithadditionalsenseof
7409h(encryptionmodemismatchonread).
11b
RAWDecryptionModeControl.Thisfieldspecifiesifthedriveshallmarkeachencryptedblock
itwritestotapeasdisabledforreadoperationswiththedecryptionmodesettoRAW.Thefield
isignorediftheEncryptionModefieldisnotsettoENCRYPT.
RDMC
ThedrivemarkseachencryptedblockaccordingtotheRDMC_Cflagsettingonthe
DataEncryptionCapabilitiespage(seepage“DataEncryptionCapabilitiespage”
(page201)).
00b
Reserved.01b
ThedrivemarkseachencryptedblockitwritesasenabledforRAWdecryptionmode
operations.
10b
ThedrivemarkseachencryptedblockitwritesasdisabledforRAWdecryptionmode
operations.
11b
IfthedecryptionmodeissettoRAWandanattemptismadetoreadorverifyanencrypted
blockthatwasdisabledforRAWdecryptionmodeoperations,thedriveterminatesthecommand
withCHECKCONDITION.ThesensekeyissettoDATAPROTECTwithadditionalsenseof
7409h(encryptedblocknotRAWread-enabled).
ClearKeyOnDemountCKOD
DataEncryptionparametersareswitchedtothedefaultvaluesupontapeunload.1
ClearKeyOnReservationPre-emptedCKORP
DataEncryptionparametersareswitchedtothedefaultvaluesuponpre-emptionof
thecurrentpersistentreservation.
IftheCKODbitissetandthereisnotapeloaded,thecommandwillbeterminated
withCHECKCONDITION,asensekeyofILLEGALREQUESTandadditionalsenseof
2400h(invalidfieldinCDB).
IftheCKORPbitissetandthereisnopersistentreservationinplacefortheI_Tnexus,
thecommandwillbeterminatedwithCHECKCONDITION,asensekeyofILLEGAL
REQUESTandadditionalsenseof2400h(invalidfieldinCDB).
1
ClearKeyOnReservationLossCKORL
DataEncryptionparametersareswitchedtothedefaultvaluesuponreservationloss.1
Nodataencryptionwillbeperformed.Disable0hEncryptionMode
DatasentviaWRITEcommandshasbeenalreadyencryptedbya
supportedencryptionalgorithm.
External1h
DatafromWRITEcommandswillbeencryptedwiththespecifiedkey.Encrypt2h
Thedataonthetapeisnotencrypted,sonodecryptionwillbe
performed.
Disable0hDecryptionMode
Dataisencryptedontape,butnodecryptionwillbeperformed.The
dataispasseddirectlytothehost.
RAW1h
Dataisencryptedontapeanddecryptionwillbeperformed.Decrypt2h
Thereisbothencryptedandnon-encrypteddataontape.Thedevice
willdecryptornotaccordingly.
Mixed3h
SECURITYPROTOCOLOUTB5h207 
						

							IftheEncryptionModeissettoEncrypt,thedrivewillsavetheKADdescriptors.Theyare
associatedwitheveryblockthatisencryptedwiththespecifiedkey.Thedescriptorsarespecified
inincreasingnumericorder.Seebelowfortheformatofthedescriptors.
Key-AssociatedData
Descriptors
Unauthenticatedkey-associateddata0hKeyDescriptorType
Authenticatedkey-associateddata1h
Noncevalue(notsupported)2h
Securitymeta-datakey-associateddata3h
Reserved.ThisisalwaysthecaseifKADdescriptorsareincluded.0hAuthenticated
Thedescriptorisnotcoveredbytheauthentication1h
Noattempthasbeenmadetoauthenticatethedescriptor2h
IntheSetDataEncryptionpageandintheDataEncryptionStatuspage(SECURITYPROTOCOL
IN),ifKADdescriptorsareincludedtheAuthenticatedfieldisalwaysreserved.
IntheNextBlockEncryptionStatuspage(SECURITYPROTOCOLIN),ifKADdescriptorsare
includedtheAuthenticatedfieldwillhavethefollowingvalues:
ifU-KAD
ifA-KAD
ifS-KAD
01h
02h
03h
KeyDescriptorformat
01234567
KeyDescriptorType0
AuthenticatedReserved(0)1
KeyDescriptorLength(n−3)2
3
KeyDescriptor4
n
SECURITYPROTOCOLOUTspecificstatus
•IfthedriveprocessesaWRITEcommandandtheKeyInstanceCounterhaschangedsince
thelasttimeitwaslocked,theWRITEcommand(andanysubsequentWRITEcommands)will
beterminatedwithCHECKCONDITION,asensekeyofDATAPROTECTandadditional
senseof2A13h(dataencryptionkeyinstancecounterchanged).Onlyahardresetora
SECURITYPROTOCOLOUTfromthesameI_Tnexuswillclearthiscondition.IftheCKODbit
issetandthereisnotapeloaded,thecommandwillbeterminatedwithCHECKCONDITION,
asensekeyofILLEGALREQUESTandadditionalsenseof2400h(invalidfieldinCDB).
•IftheCKORPbitissetandthereisnopersistentreservationinplacefortheI_Tnexus,,the
commandwillbeterminatedwithCHECKCONDITION,asensekeyofILLEGALREQUEST
andadditionalsenseof2400h(invalidfieldinCDB).
•IftheCKORLbitissetandthereisnoreservationinplacefortheI_Tnexus,,thecommand
willbeterminatedwithCHECKCONDITION,asensekeyofILLEGALREQUESTandadditional
senseof2400h(invalidfieldinCDB).
208Commands 
						

							•IftheEncryptionModeissettoEncryptandtheKeyLengthiszero,thecommandwillterminate
withCHECKCONDITION,asensekeyofILLEGALREQUESTandadditionalsenseof2600h
(invalidfieldinparameterlist).
•IftheDecryptionModeissettoDecryptorMixedandtheKeyLengthiszero,thecommand
willterminatewithCHECKCONDITION,asensekeyofILLEGALREQUESTandadditional
senseof2600h(invalidfieldinparameterlist).
SEEK(CD-ROMmode)2Bh
SEEKisexecutedfor2BhwhenthedriveisinCD-ROMmode.WhenoutofCD-ROM,theLOCATE
command,whichsharestheopcode,isexecuted.
Assumingthepre-executionchecksarepassed,GOODstatusisalwaysreported.
Pre-executionchecks
ReservationBadLUNFlagLinkIllegalField
DiagnosticStatusMediaAccessUnitAttentionDeferredError
Commanddescriptorblock
01234567
OperationCode(2Bh)0
Reserved(0)LogicalUnitNumber1
LogicalBlockAddress(MSB)2
(LSB)5
Reserved(0)6–8
Control9
CDBfields
Thisfieldisignored.LogicalBlockAddress
SENDDIAGNOSTIC1Dh
SENDDIAGNOSTICtellsthedrivetoperformeitheritsstandardself-test,ordiagnosticsspecified
intheparameterlistonitself.Theparameterlististransferredtothedriveinaseriesofdata-out
phases;each8-bytedata-outphasespecifiesadiagnostictobeperformedbythedrive.Itisnot
anerrortosetSelf-Test=0andtohaveazero-lengthparameterlist.
ThetestresultscanberetrievedwiththeRECEIVEDIAGNOSTICRESULTScommand.
Pre-executionchecks
UnitAttentionDeferredErrorReservationIllegalField
•IfSelf-Test=0,theUntOfflbitmustbeset,otherwiseCHECKCONDITIONisreported.Sense
datawillbeasdescribedinIllegalFieldChecks.
•IfSelf-Test=1,theParameterListLengthfieldmustbezero.OtherwiseCHECKCONDITION
isreported.SensedatawillbeasdescribedinIllegalFieldChecks.
•ItisnotanerrortosetSelf-Test=0andtohaveazero-lengthparameterlist.
SEEK(CD-ROMmode)2Bh209 
						

							Commanddescriptorblock
01234567
OperationCode(1Dh)0
UnitOffLDevOffL(0)Self-TestRsvd(0)PF(1)Reserved(0)1
Reserved(0)2
ParameterListLength(MSB)3
(LSB)4
Control5
CDBfields
PageFormat.SpecifiesthattheaccompanyingdatafollowstheSCSI-3DiagnosticPageformat.It
mustbesetto1.
PF
Performthediagnosticsspecifiedintheparameterlist.TheUnitOffLbitmustbeset,otherwise
CHECKCONDITIONisreported.Thedrivereportsstatuswhenthecommandhasbeen
completed.
0Self-Test
Performthestandardself-testdependingonthevalueofUnitOffL(seeabove).TheParameter
ListLengthmustbe0otherwiseCHECKCONDITIONisreported.ThedrivewillreportGOOD
statusfollowingthepre-executionchecksandbeforeexecutingthecommand.
1
DeviceOfflinebit.Mustbeclearedtozero.DevOffl
UnitOfflinebitUnitOffL
Indicatesthatthehostisnotpreparedforthedrivetoperformteststhatcouldaffectlogical
position.
0
Indicatesthatthehostispreparedforthedrivetoperformteststhatcouldaffectlogicalposition,
modifythetapeormodifycartridgestatus.ThisbitmustbesetiftheSelf-Testbitis0.
1
Indicateshowmanybytesofdiagnosticparameterdataaretobesenttothedrive.Thelength
ofthedataphaseforSENDDIAGNOSTICislimitedto4bytesofheaderplus34parameters,
eachofwhichis4byteslong.Thisgivesanupperlimitfortheparameterlistlengthof136
bytes.
ParameterList
Length
SENDDIAGNOSTICdatarequired
Nodataisrequiredifthestandardself-testistobeperformed.Otherwise,asinglediagnostic
pagemustbeprovidedasaparameter.
SENDDIAGNOSTICspecificstatus
AnySendDiagnosticcommandreceivedwithaEnclosureServicespagenumber(01hto0Fh)will
generateCHECKCONDITIONwithsensekeyofILLEGALREQUESTandadditionalsenseof3501h
(unsupportedenclosurefunction).
ThedrivereportsGOODstatusifthediagnosticspass.ItwillreportCHECKCONDITIONifthe
diagnosticsfail,withasensekeyofHARDWAREERRORandadditionalsenseof4000h.
MoredetailedresultscanthenberecoveredusingtheReceiveDiagnosticResultspage.
210Commands