This technique was pioneered in the 1970s and represented a significant breakthrough in  cryptography. The RSA algorithm is the most widely used public key technique. The power of  this approach is a public key, which is used to encrypt the data. This public key can be widely  shared, and anyone who wants to send secure data to an organization can use its public key.  The receiving organization then uses its private key to decrypt the data, which makes  public/private key encryption useful for sharing information between organizations.  This methodology is widely used on the Internet today to secure transactions, including  Secure Sockets Layer (SSL). Asymmetric key encryption is much slower and more computationally intensive than  symmetric key encryption. The advantage of asymmetric key encryption is the ability to share  secret data without sharing the encryption key. There are three different methods of encryption management available. These methods differ  in where the key manager application is located. The operating environment determines  which is best, with the result that key management and the encryption policy engine can be in  any one of the environmental layers that are described next. The application-managed tape encryption method is best in operating environments that run  an application that already can generate and manage encryption policies and keys, such as  the IBM Security Key Lifecycle Manager Policies that specify when encryption is to be used  are defined through the application interface. The policies and keys pass through the data  path between the application layer and the encryption-capable tape drives.  Encryption is the result of interaction between the application and the encryption-enabled  tape drive and is transparent to the system and library layers. Because the application  manages the encryption keys, volumes that are written and encrypted with the application  method can be read only by using the application-managed tape encryption method. Application-managed encryption is provided at no cost for those IBM tape drives that support  encryption.  The system-managed tape encryption method can be used for open systems operating  environments where there is no application that is capable of key management. Encryption  policies that specify when to use encryption are set up through each instance of the IBM  device driver.  Key generation and management are performed by the key manager, a Java application that  is running on the host or externally on another host. Policy controls and keys pass through the  data path between the system layer and the TS1160, TS1155, TS1150, TS1140, TS1130,  TS1120, and Ultrium 8, 7, 6, and 5 tape drives that are installed in the libraries.  IBM Security Key Lifecycle Manager is required for enabling system-managed tape  encryption for Ultrium 8, 7, 6, and 5. Chapter 2. Overview of IBM LTO Ultrium tape drives  71 System-managed tape encryption Application-managed tape encryption Managing encryption Encryption is transparent to the applications. System-managed tape encryption and  library-managed tape encryption are transparent to one another. A tape that is encrypted by  using system-managed encryption can be decrypted by using library-managed encryption.  The reverse is true, if they both have access to the same key manager keystore .