How to add hardware encryption to IBM LTO 4 drive

Bought a Tandberg Data Full-Height external LTO 4 drive (1640LTO, 7202) with SCSI connection and was disappointed to find it did not support encryption. Stenc refused to do anything, and it matched the behaviour from this article with the raw SCSI commands: https://www.stroppykitten.com/technical/fun-with-scsi-tapes

# stenc -f /dev/nst0 --detail
Status for /dev/nst0
--------------------------------------------------
Device Mfg:              IBM     
Product ID:              ULTRIUM-TD4     
Product Revision:        74H6
Sense Code:              Illegal Request (0x05)
 ASC:                    0x24
 ASCQ:                   0x00

Across various datasheets I found various mentions that the SCSI edition of the FH IBM LTO4 drive does not support encryption, but confusingly that some OEM editions do. It seemed likely that the physical chips were present but disabled.

Inside was an IBM drive (hence the title) with firmware 74H6 and part number 95P6015. From a lot of Googling, I found changelogs mentioning encryption, so determined the best way forward was to attempt to update the firmware, as 74H6 appeared to be the original firmware. Tandberg themselves never released an update that I could find, so I had to guess the equivalent IBM drive. This turned out to be TS3100/3200 series (or possibly TS2340) and after hitting paywalls on the IBM site, a lot more searching led me to https://datacentersupport.lenovo.com/gb/en/products/storage/tape-and-backup/ts3200/6173/downloads/driver-list/component?name=Software%20and%20Utilities

The firmware file from LTO4 Tape Drive Microcode C7QH FH Legacy for TS3100/TS3200 installed with ITDT (IBM Tape Diagnostic Tool), which is available freely from IBM for various platforms.

With this firmware installed (impressive seeing a 2016 firmware for a 2007 drive), stenc magically started working.