NetWorker for instance doesn’t currently support key management for hardware tape encryption. However, so long as the key management is run outside of it (e.g., via the library or the OS), it will work without issue – i.e., the encryption is invisible to it and can be used. I have multiple customers already taking advantage of this.

There are other encryption options – e.g., (formerly Neoscale) Thales nCipher provides black box (or more precisely red box) level encryption at the fibre-channel layer itself. The nCipher device for instance is able to cooperate with many enterprise backup products to allow multiple keys, allows per-volume encryption controls, etc.

I think that if critical *data* is encrypted, that’s fine. But encrypt it before it hits the tape. Besides, you really need to keep tight physical controls on the tape in the first place that should be enough.

Note: I’ve not read the HP paper, but will take a quick peek. Thanks for the link.