608 Implementing the IBM Storwize V7000 with IBM Spectrum Virtualize V8.2.1
Consider the following points regarding encryption keys:
/SM590000Keys are unique for each object, and they are created when the object is created. 
/SM590000Two types of keys are defined in the system:
– Master access key:
 The master access key is created when encryption is enabled. 
 The master access key can be stored on USB flash drives, key servers, or both. 
One master access key is created for each enabled encryption key provider.
 It can be copied or backed up as necessary.
 It is not permanently stored anywhere in the system.
 It is required at boot time to unlock access to encrypted data.
– Data encryption keys (one for each encrypted object):
 Data encryption keys are used to encrypt data. When an encrypted object (such as 
an array, a pool, or a child pool) is created, a new data encryption key is generated 
for this object.
 Managed disks (MDisk) that are not self-encrypting are automatically encrypted by 
using the data encryption key of the pool or child pool to which they belong.
 MDisks that are self-encrypting are not reencrypted by using the data encryption 
key of the pool or child pool they belong to by default. You can override this default 
by manually configuring the MDisk as not self-encrypting.
 Data encryption keys are stored in secure memory.
 During cluster internal communication, data encryption keys are encrypted with the 
master access key.
 Data encryption keys cannot be viewed.
 Data encryption keys cannot be changed.
 When an encrypted object is deleted, its data encryption key is discarded ( secure 
erase).
12.2.4  Encryption licenses
Encryption is a licensed feature that uses key-based licensing. A license must be present for 
each control enclosure in the system before you can enable encryption.
If you add a control enclosure to a system that has encryption enabled, the control enclosure 
must also be licensed.
Important: If all master access key copies are lost and the system must cold restart, all 
encrypted data is gone. No method exists, even for IBM, to decrypt the data without the 
keys. If encryption is enabled and the system cannot access the master access key, all 
SAS hardware is offline, including unencrypted arrays.
Note: A self-encrypting MDisk is an MDisk from an encrypted volume in an external 
storage system.