Active Master Key; Alternate Master Key; Master Key Actions - Brocade Communications Systems StoreFabric SN6500B User Manual

20
Master keys
The new master key cannot be used (no new data encryption keys can be created, so no new
encrypted LUNs can be configured), until you back up the new master key. After you have backed
up the new master key, it is strongly recommended that all encrypted disk LUNs be rekeyed.
rekeying causes a new data encryption key to be created and encrypted using the new active
master key, thereby removing any dependency on the old master key. Refer to
master key"
Master key actions are disabled if they are unavailable. For example:
•
•
NOTE
It is important to back up the master key because if the master key is lost, none of the data
encryption keys can be restored and none of the encrypted data can be decrypted.

Active master key

The active master key is used to encrypt newly created data encryption keys (DEKs) prior to sending
them to a key vault to be stored. You can restore the active master key under the following
conditions:
•
•

Alternate master key

The alternate master key is used to decrypt data encryption keys that were not encrypted with the
active master key. Restore the alternate master key for the following reasons:
•
•

Master key actions

NOTE
Master keys belong to the group and are managed from Group Properties.
Master key actions are as follows:
•
670
on page 678 for more information.
The user does not have Storage Encryption Security permissions.
The group leader is not discovered or managed by the Management application.
The active master key has been lost, which happens if all encryption engines in the group have
been zeroized or replaced with new hardware at the same time.
You want multiple encryption groups to share the same active master key. Groups should share
the same master key if the groups share the same key vault and if tapes (or disks) are going to
be exchanged regularly between the groups.
To read an old tape that was created when the group used a different active master key.
To read a tape (or disk) from a different encryption group that uses a different active
master key.
Backup master key: Enabled any time a master key exists. Selecting this option launches the
Backup Master Key for Encryption Group dialog box.
You can back up the master key to a file, to a key vault, or to a smart card. You can back up the
master key multiple times to any of these media in case you forget the passphrase you
originally used to back up the master key, or if multiple administrators each needs a
passphrase for recovery.
"Creating a new
Brocade Network Advisor SAN User Manual
53-1002696-01