HP Secure Encryption manual Working with keys, Changing the Master Encryption Key

Page 39

Working with keys

Changing the Master Encryption Key

IMPORTANT: HP recommends that you keep a record of the Master Encryption Keys when encryption is configured in Local Mode. The local Master Encryption Key is not displayed by any available tool or firmware because it is considered a cryptographic secret by FIPS 140-2. HP Secure Encryption design follows the NIST architecture requirements and does not allow HP to assist in the recovery of a lost Master Encryption Key.

To change the Master Encryption Key:

1.Open Encryption Manager ("Opening Encryption Manager" on page 33).

2.Log in to Encryption Manager ("Logging into Encryption Manager" on page 33).

3.Under Settings, locate Master Key. Click Change Master Key.

4.A new window appears. Enter the new Master Key in the field provided. The Master Key name must be between 8 and 64 characters.

5.Click OK.

Rekeying the Drive Encryption Keys

This procedure creates a new set of Drive Keys used for encrypting the volume keys on the controller. This task is available to all roles in the system.

To rekey the Drive Keys:

1.Open Encryption Manager ("Opening Encryption Manager" on page 33).

2.Log in to Encryption Manager ("Logging into Encryption Manager" on page 33).

Operations 39

Image 39

Contents HP Secure Encryption Installation and User Guide Page Contents Support and other resources About HP Secure Encryption OverviewBenefits Encryption featuresFeature Description Eskm Solution components HP Smart Storage AdministratorHP ProLiant servers Minimum requirements HP Smart Array ControllerHP SmartCache HP iLOHP Eskm and key management HP Enterprise Secure Key Manager 3.1 and laterLicensing Planning Encryption setup guidelinesRecommended security settings at remote sites Encrypted backupsSecurity domains Deployment scenariosRemote and local key management requirements Configuration Local key management modeConfiguring the controller local mode Configuration Configuring Remote Key Management Mode Remote Key Management ModeConfiguring the HP Eskm Logging in to the HP EskmAdding a user Configuration Adding a group Assigning a user to a group Configuration Configuration Creating a Master Key Running a key query Placing a key in a groupConfiguration Assigning a key to a group Configuring HP iLO Connecting HP iLO to HP Eskm Configuration Configuring the controller remote mode Configuration Logging into Encryption Manager Accessing Encryption ManagerOperations Opening Encryption ManagerSet or change the Crypto Officer password Managing passwordsSet or change user account password Set or change the password recovery questionSet or change the controller password Suspending the controller password Resuming the controller password Working with keys Changing the Master Encryption KeyRekeying the Drive Encryption Keys Rescanning keys Creating a plaintext volumeOperations Operations Converting plaintext volumes into encrypted volumes Changing key management modes Enabling/disabling plaintext volumes Enabling/disabling the firmware lock Enabling/disabling local key cache Importing drives with different Master Keys Importing drive sets in Local Key Management ModeOperations Controllers MaintenanceEncryption Manager DrivesFlashing firmware Replacing a physical driveGroups Locating groups associated with a driveQuery by drive serial number Maintenance Query by previous server name Maintenance Displaying log information Running queries Maintenance Maintenance Maintenance Lost or forgotten controller password TroubleshootingCommon issues Lost or forgotten Crypto Officer passwordLost or forgotten Master Key Local modeRemote mode Locating the key using the HP EskmLocating the key using iLO Forgotten which Master key goes with which drive Master key not exporting Logical drives remain offlineTesting the connection between HP iLO and the HP Eskm Potential errors encountered Error Description Action Clearing the encryption configuration Support and other resources Before you contact HPHP contact information Encryption algorithms AppendixGlossary Plaintext ILOLocal Master Encryption Key Master Encryption KeyRemote Key Manager Volume encryption keyDocumentation feedback Eskm IndexIndex