Is software encryption fast enough for writing to tape?

[Libby]

I'm thinking of using Veeam Backup & Replication CE 11.0 with an IBM TS-3200 library and LTO-8 drive. I'd need it encrypted and would like to use software encryption.

However, I've read here that there were significant speed issues with software encryption in the past: tape-f29/ibm-ts3200-and-hardware-encryption-t29322.html

This would be a concern for me as I believe that if the encryption speed is slower than the tape writing speed this would cause shoe-shining on the tape. But this thread is from 2015, and I read in one place that modern CPUs with AES-NI don't have this problem anymore. Is this true?

I have no way to easily test this, so I would appreciate if anyone could shine some light on the issue.

[HannesK]

Hello,
and welcome to the forums.

What is "fast enough"? What do you think about trying it out and posting your results and helping others with that?

If it's too slow, you could also use encryption in the backup job. Then the data is encrypted before writing to tape. It also takes CPU cycles, but it seems to be irrelevant today.

Best regards,
Hannes

[Libby]

Hi, and thanks for the welcome

As you may have guessed from my question I'm new to Veeam and tape backups in general.

So by "fast enough" I'm trying to ask a blanket question on whether software encryption speed is still a concern in some cases, or whether CPUs with AES-NI are so fast that these days that it's generally no longer a bottleneck. Due to my inexperience, trying to set everything up for various tests and running them is a big project for me. I was hoping to save myself this trial and error time if the question has an answer that is clear to experienced users.

To be a bit more specific, I believe the maximum write speed to LTO-8 is 360 MB/s, so I need to hit at least that. The data pool I'd like to back up from will have a theoretical maximum output of around 500 MB/s, which I imagine is fine, unless the CPU throttles the speed by half or more as reported in 2015. The CPU I'm going to use is a Xeon E3-1230 v3, which has AES-NI.

Thanks for the tip with the backup job encryption, I'll have to look into that.

[vmtech123]

You want to hit AT LEAST the Max speed? I am confused, as the max speed is the absolute top in perfect conditions and not always the case.

While there is a performance hit, it really depends on your requirements for encryption, backup window, etc. Get a second drive if you need more throughput. Extend your backup window, Encrypt the jobs. There are a few options.

While running 6 LTO tapes in my TS4500 I noticed about a 20% performance hit turning on software encryption. added a few hours to my window, but I'm backing up 100's of TB's so it's minor. I may get another drive to account for that.

[Dima P.]

Hardware encryption has literary zero impact on the performance as data blocks are encrypted by the drive itself while landing the tape. Software encryption is slower compared to hardware encryption as it requires data pre-processing on the host (block should be encrypted by Veeam before it lands the tape). If you have to pick what to use - I'd recommend going with hardware encryption.

[RobTurk]

.. To be a bit more specific, I believe the maximum write speed to LTO-8 is 360 MB/s, so I need to hit at least that.

Perhaps good to know is that modern LTO tape drives include speed matching technology (aka Data rate matching).
They can dynamically slow down to match the incoming data stream without negative impact.

[vmtech123]

I have tape drives that support hardware encryption. LTO8 drives on my TS4500's.

Dumb me, Edit, because I just found in the TS4500, i had to tell it that my Virtual Library encryption was "application managed"

I had Veeam set up correctly.

Hopefully I get that speed back

[Libby]

Perhaps good to know is that modern LTO tape drives include speed matching technology (aka Data rate matching).
They can dynamically slow down to match the incoming data stream without negative impact.

Very helpful, thank you!

I thought I had to hit at least the max speed of the drive in order to not have problems, but it appears that the minimum speed allowed with data rate matching for LTO-8 is actually only 112MB/s, so I have a lot less concern about that.