Chapter 12. Encryption 605
/SM590000Encryption of data at-rest complies with the Federal Information Processing Standard 140 
(FIPS-140) standard, but is not certified.
/SM590000Ciphertext stealing XTS-AES-256 is used for data encryption.
/SM590000AES 256 is used for master access keys.
/SM590000The algorithm is public. The only secrets are the keys.
/SM590000A symmetric key algorithm is used. The same key is used to encrypt and decrypt data.
The encryption of system data and metadata is not required, so they are not encrypted. 
12.2.1  Encryption methods
There are two types of encryption on devices running IBM Spectrum Virtualize: hardware 
encryption and software encryption. Both methods of encryption protect against the potential 
exposure of sensitive user data that is stored on discarded, lost, or stolen media. Both can 
also facilitate the warranty return or disposal of hardware. 
Which method is used for encryption is chosen automatically by the system based on the 
placement of the data:
/SM590000Hardware encryption: Data is encrypted by using serial-attached SCSI (SAS) hardware. 
Used only for internal storage (drives).
/SM590000Software encryption: Data is encrypted by using nodes’ CPU (encryption code uses 
AES-NI CPU instruction set). Used only for external storage.
Both methods of encryption use the same encryption algorithm, key management 
infrastructure, and license. 
12.2.2  Encrypted data
IBM Spectrum Virtualize performs data-at-rest encryption, which is the process of encrypting 
data that is stored on the end devices, such as physical drives. 
Data is encrypted or decrypted when it is written to or read from internal drives (hardware 
encryption) or external storage systems (software encryption).
So, data is encrypted when transferred across the SAN only between IBM Spectrum 
Virtualize systems and external storage. Data is not encrypted when transferred on SAN 
interfaces under the following circumstances:
/SM590000Server-to-storage data transfer
/SM590000Remote copy (for example, Global or Metro Mirror)
/SM590000Intracluster communication
Note: Software encryption is available in IBM Spectrum Virtualize code V7.6 and later.
Note: The design for encryption is based on the concept that a system is encrypted or not 
encrypted. Encryption implementation is intended to encourage solutions that contain only 
encrypted volumes or only unencrypted volumes. For example, after encryption is enabled 
on the system, all new objects (for example, pools) are by default created as encrypted.
Note: Only data-at-rest is encrypted. Host to storage communication and data that is sent 
over links that are used for Remote Mirroring are not encrypted.