anchor.diff:  Each line defines a key ID and then the Base64-encoded cipher text of a 16 byte IV and wrapped AES-128, AES-192, or AES-256 key depending on the JCE policies available. The individual keys are wrapped by AES/GCM encryption using the **root key** defined by `nifi.bootstrap.sensitive.key` in _conf/bootstrap.conf_.
   
   ==== KeyStoreKeyProvider
  -The `KeyStoreKeyProvider` implementation reads from a standard `java.security.KeyStore` using the configured password to load AES Secret Key entries.
  -
  -The provider supports the following Keystore Types:
  -
  -* BCFKS
  -* PKCS12
  -
  -The keystore filename extension must be either `.p12` indicating PKCS12 or `.bcfks` indicating BCFKS.
  -
  -The `keytool` command can be used to generate an AES-256 Secret Key stored in a PKCS12 file for repository encryption:
  -
  -...
  -keytool -genseckey -alias primary-key -keyalg AES -keysize 256 -keystore repository.p12 -storetype PKCS12
  -...
  -
  -Enter a keystore password when prompted. The same value must be used for both the keystore password and key password.
  -The keystore password will be used in the provider configuration properties.
  +
  +See <<secret-key-generation-and-storage-using-keytool>> for details on generating and storing an AES Secret Key for use with the `KeyStoreKeyProvider`.
   
   The following configuration properties support using a PKCS12 keystore with a Secret Key:
   
  -...
  -nifi.flowfile.repository.encryption.key.provider.implementation=org.apache.nifi.security.kms.KeyStoreKeyProvider
  -nifi.flowfile.repository.encryption.key.provider.location=./conf/repository.p12
  -nifi.flowfile.repository.encryption.key.provider.password=KEYSTORE_PASSWORD
  -nifi.flowfile.repository.encryption.key.id=primary-key
  -...
  +  nifi.flowfile.repository.encryption.key.provider.implementation=org.apache.nifi.security.kms.KeyStoreKeyProvider
  +  nifi.flowfile.repository.encryption.key.provider.location=./conf/repository.p12
  +  nifi.flowfile.repository.encryption.key.provider.password=KEYSTORE_PASSWORD
  +  nifi.flowfile.repository.encryption.key.id=primary-key
  +
  +The same configuration can be used with a BCFKS keystore using a different location property:
  +
  +  nifi.flowfile.repository.encryption.key.provider.location=./conf/repository.bcfks
   
   [[flowfile-repository-key-rotation]]
   ==== Key Rotation
  
positive.code: Each line defines a key ID and then the Base64-encoded cipher text of a 16 byte IV and wrapped AES-128, AES-192, or AES-256 key depending on the JCE policies available. The individual keys are wrapped by AES/GCM encryption using the **root key** defined by `nifi.bootstrap.sensitive.key` in _conf/bootstrap.conf_.
  
  ==== KeyStoreKeyProvider
  The `KeyStoreKeyProvider` implementation reads from a standard `java.security.KeyStore` using the configured password to load AES Secret Key entries.
  
  The provider supports the following Keystore Types:
  
  * BCFKS
  * PKCS12
  
  The keystore filename extension must be either `.p12` indicating PKCS12 or `.bcfks` indicating BCFKS.
  
  The `keytool` command can be used to generate an AES-256 Secret Key stored in a PKCS12 file for repository encryption:
  
  ...
  keytool -genseckey -alias primary-key -keyalg AES -keysize 256 -keystore repository.p12 -storetype PKCS12
  ...
  
  Enter a keystore password when prompted. The same value must be used for both the keystore password and key password.
  The keystore password will be used in the provider configuration properties.
  
  The following configuration properties support using a PKCS12 keystore with a Secret Key:
  
  ...
  nifi.content.repository.encryption.key.provider.implementation=org.apache.nifi.security.kms.KeyStoreKeyProvider
  nifi.content.repository.encryption.key.provider.location=./conf/repository.p12
  nifi.content.repository.encryption.key.provider.password=KEYSTORE_PASSWORD
  nifi.content.repository.encryption.key.id=primary-key
  ...
  
  .Data Protection vs. Key Protection
  ****
  
negative.code: Each line defines a key ID and then the Base64-encoded cipher text of a 16 byte IV and wrapped AES-128, AES-192, or AES-256 key depending on the JCE policies available. The individual keys are wrapped by AES/GCM encryption using the **root key** defined by `nifi.bootstrap.sensitive.key` in _conf/bootstrap.conf_.
  
  ===== KeyStoreKeyProvider
  
  See <<secret-key-generation-and-storage-using-keytool>> for details on generating and storing an AES Secret Key for use with the `KeyStoreKeyProvider`.
  
  The following configuration properties support using a PKCS12 keystore with a Secret Key:
  
    nifi.provenance.repository.encryption.key.provider.implementation=org.apache.nifi.security.kms.KeyStoreKeyProvider
    nifi.provenance.repository.encryption.key.provider.location=./conf/repository.p12
    nifi.provenance.repository.encryption.key.provider.password=KEYSTORE_PASSWORD
    nifi.provenance.repository.encryption.key.id=primary-key
  
  The same configuration can be used with a BCFKS keystore using a different location property:
  
    nifi.provenance.repository.encryption.key.provider.location=./conf/repository.bcfks
  
  [[provenance-repository-key-rotation]]
  ===== Key Rotation
  