text: (cid:2) Encryption of data at-rest complies with the Federal Information Processing Standard 140 
  (FIPS-140) standard, but is not certified. 
  
  (cid:2) Ciphertext stealing XTS-AES-256 is used for data encryption. 
  
  (cid:2) AES 256 is used for master access keys. 
  
  (cid:2) The algorithm is public. The only secrets are the keys. 
  
  (cid:2) A symmetric key algorithm is used. The same key is used to encrypt and decrypt data. 
  
  The encryption of system data and metadata is not required, so they are not encrypted. 
  
  **12.2.1 Encryption methods**
  
  There are two types of encryption on devices running IBM Spectrum Virtualize: hardware 
  encryption and software encryption. Both methods of encryption protect against the potential 
  exposure of sensitive user data that is stored on discarded, lost, or stolen media. Both can 
  also facilitate the warranty return or disposal of hardware. 
  
  Which method is used for encryption is chosen automatically by the system based on the 
  placement of the data: 
  
  (cid:2) Hardware encryption: Data is encrypted by using serial-attached SCSI (SAS) hardware. 
  Used only for internal storage (drives). 
  
  (cid:2) Software encryption: Data is encrypted by using nodes’ CPU (encryption code uses 
  AES-NI CPU instruction set). Used only for external storage. 