Abstract: Storing and retrieving ciphertext in data storage can include determining a first ciphertext value for a first data chunk to be saved to a client-server data storage system using an encrypted chunk hash value associated with the first data chunk as an initial value, and storing the first data chunk on a server in the client-server data storage system in response to determining that the first ciphertext value is a unique ciphertext value. Also, storing and retrieving ciphertext in data storage can include decrypting a ciphertext value for a second data chunk received from a client in the client-server data storage system and based on an encrypted chunk hash value associated with the second data chunk, and sending the second data chunk to the client in response to determining that the decrypted ciphertext value corresponds to an original data chunk saved to the server by the client.

Abstract: Embodiments include methods, apparatus, and systems for managing encryption keys in a storage library. One method includes receiving a request to read or write data to a tape drive; initiating, by the tape drive, a request for an encryption key to encrypt or decrypt the data; and transmitting the encryption to key to the tape drive through an out-of-band path.

Abstract: Embodiments include methods, apparatus, and systems for managing encryption keys in a storage library. One method includes using a tape library to determine which key manager is selected for data encryption operations to a tape drive when multiple different key managers exist in a storage system.