This technique was pioneered in the 1970s and represented a significant breakthrough in cryptography. The RSA algorithm is the most widely used public key technique. The power of this approach is a public key, which is used to encrypt the data. This public key can be widely shared, and anyone who wants to send secure data to an organization can use its public key. The receiving organization then uses its private key to decrypt the data, which makes public/private key encryption useful for sharing information between organizations. 

This methodology is widely used on the Internet today to secure transactions, including Secure Sockets Layer (SSL). 

Asymmetric key encryption is much slower and more computationally intensive than symmetric key encryption. The advantage of asymmetric key encryption is the ability to share secret data without sharing the encryption key. 

## Managing encryption 

There are three different methods of encryption management available. These methods differ in where the key manager application is located. The operating environment determines which is best, with the result that key management and the encryption policy engine can be in any one of the environmental layers that are described next. 

## Application-managed tape encryption 

The application-managed tape encryption method is best in operating environments that run an application that already can generate and manage encryption policies and keys, such as the IBM Security Key Lifecycle Manager Policies that specify when encryption is to be used are defined through the application interface. The policies and keys pass through the data path between the application layer and the encryption-capable tape drives. 

Encryption is the result of interaction between the application and the encryption-enabled tape drive and is transparent to the system and library layers. Because the application manages the encryption keys, volumes that are written and encrypted with the application method can be read only by using the application-managed tape encryption method. 

Application-managed encryption is provided at no cost for those IBM tape drives that support encryption. 

## System-managed tape encryption 

The system-managed tape encryption method can be used for open systems operating environments where there is no application that is capable of key management. Encryption policies that specify when to use encryption are set up through each instance of the IBM device driver. 

Key generation and management are performed by the key manager, a Java application that is running on the host or externally on another host. Policy controls and keys pass through the data path between the system layer and the TS1160, TS1155, TS1150, TS1140, TS1130, TS1120, and Ultrium 8, 7, 6, and 5 tape drives that are installed in the libraries. 

Encryption is transparent to the applications. System-managed tape encryption and library-managed tape encryption are transparent to one another. A tape that is encrypted by using system-managed encryption can be decrypted by using library-managed encryption. The reverse is true, if they both have access to the same key manager keystore . 

IBM Security Key Lifecycle Manager is required for enabling system-managed tape encryption for Ultrium 8, 7, 6, and 5. 

