Hardware specifications

Encryption algorithm

Advanced Encryption Standard (AES) 256 bit

Encryption mode

XTS mode

Encryption module standard

VSP G200: Compliant to FIPS 140-2 Level 1

VSP G400, G600, G800, VSP F400, F600, F800: Compliant to FIPS 140-2 Level 2

VSP G1000, VSP G1500, and VSP F1500: Compliant to FIPS 140-2 Level 1 and Level 2^*

LDEVs that you can encrypt

Volume type

Open, mainframe, multiplatform

Emulation type

All emulation types

Internal/external LDEVs

Internal LDEVs only

LDEV with existing data

Supported. Requires data migration.

Managing data encryption keys

Creating data encryption keys

Use your system's storage management software to create encryption keys.

Deleting data encryption keys

Use your system's storage management software to delete encryption keys.

However, you cannot delete encryption keys that are allocated to implemented drives.

Unit of encryption/decryption

Parity group. Data encryption key is used per HDD.

Scope of data encryption keys

• For VSP G200:

512 encryption keys per storage system. You can create 512 Free keys or DEKs. Additionally, you can create 4 CEKs and one KEK. Therefore, the total maximum number of encryption keys will be 517 when including CEKs and KEKs.

• For VSP G400, G600 and VSP F400, F600:

1,024 encryption keys per storage system. You can create 1,024 Free keys or DEKs. Additionally, you can create 4 CEKs and one KEK. Therefore, the total maximum number of encryption keys will be 1,029 when including CEKs and KEKs.

• For VSP G800 and VSP F800:

2,048 encryption keys per storage system. You can create 2,048 Free keys or DEKs. Additionally, you can create 16 CEKs and one KEK. Therefore, the total maximum number of encryption keys will be 2,065 when including CEKs and KEKs.

• For :

4,096 encryption keys per storage system. You can create 4,096 Free keys or DEKs. Additionally, you can create 32 CEKs and one KEK. Therefore, the total maximum number of encryption keys will be 4,129 when including CEKs and KEKs.

Attribute of encryption keys

The following attributes will be set for the encryption keys:

• Free The unused key before allocating the encryption key.
• DEK The data encryption key. The key for the encryption of the stored data.
• CEK The certificate encryption key. The key for the encryption of the certificate and the key for the encryption of DEK per HDD.
• KEK The key encryption key. The key for the encryption of the CEK.

Backup/Restore functionality

Redundant (primary and secondary) backup/restore copies

* To use encryption modules compliant to FIPS 140-2 Level 2, contact customer support.