See “Enabling encryption using key servers” on page 265 for instructions on how to enable encryption using key servers as the sole encryption key provider. 

## Enabling encryption using USB flash drives 

Note:  The system needs at least three USB flash drives to be present before you can enable encryption using this encryption key provider. IBM USB flash drives are preferred, although other flash drives might work. You can use any USB ports in any node of the cluster. 

Using USB flash drives as the encryption key provider requires a minimum of three USB flash drives to store the generated encryption keys. Because the system will attempt to write the encryption keys to any USB key inserted into a node port, it is critical to maintain physical security of the system during this procedure. 

While the system enables encryption, you are prompted to insert USB flash drives into the system. The system generates and copies the encryption keys to all available USB flash drives. 

Ensure that each copy of the encryption key is valid before you write any user data to the system. The system validates any key material on a USB flash drive when it is inserted into the canister. If the key material is not valid, the system logs an error. If the USB flash drive is unusable or fails, the system does not display it as output. 

If your system is in a secure location with controlled access, one USB flash drive for each canister can remain inserted in the system. If there is a risk of unauthorized access, then all USB flash drives with the master access keys must be removed from the system and stored in a secure place. 

Securely store all copies of the encryption key. For example, any USB flash drives holding an encryption key copy that are not left plugged into the system can be locked in a safe. Similar precautions must be taken to protect any other copies of the encryption key that are stored on other media. 

Notes: Generally, create at least one additional copy on another USB flash drive for storage in a secure location. You can also copy the encryption key from the USB drive and store the data on other media, which can provide additional resilience and mitigate risk that the USB drives used to store the encryption key come from a faulty batch. 

Every encryption key copy must be stored securely to maintain confidentiality of the encrypted data. 

A minimum of one USB flash drive with the correct master access key is required to unlock access to encrypted data after a system restart such as a system-wide reboot or power loss. No USB flash drive is required during a warm reboot, such as a node exiting service mode or a single node reboot. The data center power-on procedure needs to ensure that USB flash drives containing encryption keys are plugged into the storage system before it is powered on. 

During power-on, insert USB flash drives into the USB ports on two supported canisters to safeguard against failure of a node, node’s USB port, or USB flash drive during the power-on procedure. 

