656 Implementing the IBM Storwize V7000 with IBM Spectrum Virtualize V8.2.1
12.7  Recovering from a provider loss
If both encryption key providers are enabled, and you lose one of them (by losing all copies of 
the encryption key kept on the USB flash drives or by losing all SKLM servers), you can 
recover from this situation by disabling the provider to which you lost the access. To disable 
the unavailable provider, you must have access to a valid master access key on the remaining 
provider.
If you have lost access to the encryption key server provider, issue the following command:
chencryption -keyserver disable
If you have lost access to the USB flash drives provider, issue the following command:
chencryption -usb disable
If you want to restore the configuration with both encryption key providers, follow the 
instructions that are described in 12.5, “Configuring more providers” on page 647.
12.8  Using encryption
The design for encryption is based on the concept that a system is fully encrypted or not 
encrypted. Encryption implementation is intended to encourage solutions that contain only 
encrypted volumes or only unencrypted volumes. For example, after encryption is enabled on 
the system, all new objects (for example, pools) are by default created as encrypted. 
Some unsupported configurations are actively policed in code. For example, no support exists 
for creating unencrypted child pools from encrypted parent pools. However, exceptions exist:
/SM590000During the migration of volumes from unencrypted to encrypted volumes, a system might 
report both encrypted and unencrypted volumes.
/SM590000It is possible to create unencrypted arrays from CLI by manually overriding the default 
encryption setting.
Note: If you lose access to all encryption key providers that are defined in the system, no 
method is available to recover access to the data protected by the master access key.
Notes: Encryption support for Distributed RAID is available in IBM Spectrum Virtualize 
code V7.7 and later.
You must decide whether to encrypt or not encrypt an object when it is created. You cannot 
change this setting later. To change the encryption state of stored data, you must migrate 
from an encrypted object (for example, pool) to an unencrypted one, or vice versa. Volume 
migration is the only way to encrypt any volumes that were created before enabling 
encryption on the system.