ES GuardPoint Encryption Keys

ES GuardPoints must be encrypted using XTS-AES 256 keys. An XTS-AES 256 type key is a 512-bit key composed of two components:

• The first 256 bits of the key is the AES 256 encryption key component

• The second 256 bits is the tweak component

You create XTS keys on the CipherTrust Manager using the “Add Key” function, similar to non-XTS keys.

Note

You must check the KMIP Accessible check box on the “Add Agent Key” page to make the key available to KMIP clients through KMIP. If you do not check the KMIP Accessible option, storage arrays cannot get keys for CTE-Efficient Storage devices from the CipherTrust Manager (KMIP server) for sharing those keys with protected hosts.

The CipherTrust Manager also generates a UUID for a newly added key. The CipherTrust Manager provides the key and its attributes to the protected hosts for guarding the CTE-Efficient Storage device. The protected host for the device writes the ES Header to the device, including the UUID of the key, before the initial attempt to enable an ES GuardPoint. The storage array recognizes the ES Header written to the device, retrieves the UUID from the ES Header, and retrieves information and attributes of the AES 256 component of the XTS-AES 256 key from the CipherTrust Manager using KMIP.