Brocade Fabric OS Encryption Administrator’s Guide Supporting Key Management Interoperability Protocol (KMIP) Key-Compliant Environments (Supporting Fabric OS v7.1.0) - Manual (Page 118)

100 Fabric OS Encryption Administrator’s Guide (KMIP)
53-1002747-02
Master keys
2
The new master key cannot be used (no new data encryption keys can be created, so no new
encrypted LUNs can be configured), until you back up the new master key. After you have backed
up the new master key, it is strongly recommended that all encrypted disk LUNs be rekeyed.
rekeying causes a new data encryption key to be created and encrypted using the new active
master key, thereby removing any dependency on the old master key. Refer to
“Creating a master
key” on page 108 for more information.
Master key actions are disabled if they are unavailable. For example:
• The user does not have Storage Encryption Security permissions.
• The Group Leader is not discovered or managed by BNA.
NOTE
It is important to back up the master key because if the master key is lost, none of the data
encryption keys can be restored and none of the encrypted data can be decrypted.
Active master key
The active master key is used to encrypt newly created data encryption keys (DEKs) prior to sending
them to a key vault to be stored. You can restore the active master key under the following
conditions:
• The active master key has been lost, which happens if all encryption engines in the group have
been zeroized or replaced with new hardware at the same time.
• You want multiple encryption groups to share the same active master key. Groups should share
the same master key if the groups share the same key vault and if tapes (or disks) are going to
be exchanged regularly between the groups.
Alternate master key
The alternate master key is used to decrypt data encryption keys that were not encrypted with the
active master key. Restore the alternate master key for the following reasons:
• To read an old tape that was created when the group used a different active master key.
• To read a tape (or disk) from a different encryption group that uses a different active
master key.
Master key actions
NOTE
Master keys belong to the group and are managed from Group Properties.
Master key actions are as follows:
• Backup master key: Enabled any time a master key exists. Selecting this option launches the
Backup Master Key for Encryption Group dialog box.
You can back up the master key to a file, to a key vault, or to a smart card. You can back up the
master key multiple times to any of these media in case you forget the passphrase you
originally used to back up the master key, or if multiple administrators each needs a
passphrase for recovery.