chencryption

Use the chencryption command to manage the encryption state of the system.

Syntax

Parameters

-usb enable | disable | validate | newkey

(Required if you do not specify -keyserver) Specifies whether USB encryption is enabled (or disabled) or the encryption keys are validated. You can also create new encryption keys that are also stored on Universal Serial Bus (USB) flash drives for use if the system forgets the encryption keys.

-usb enable: Enables encryption capability on the system. Then specify -usb newkey to create new keys. Use this command when the system has encryption hardware and encryption licenses (for example, the lsencryption value for status is set to licensed).
-usb disable: Disables the encryption capability of the system. If no encryption key is prepared this operation is complete and no further action is needed. Do not use this command if an encryption key is prepared or encrypted objects exist.
Remember: This removes all encryption keys (that are not on the USB flash drive) from the system.
-usb validate: Verifies that encryption keys are present on the USB flash drive and makes sure that the keys match the system encryption keys. Use this command when encryption is enabled and encryption keys exist (for example, lsencryption value for usb_rekey is set to no).
-usb newkey: Generates a new encryption key on a USB flash drive that is attached to the system. Use this command only if the minimum number of USB flash drives that can be used as key material stores are attached to the system (as reported by lsportusb). When you specify this parameter, the -key option must also be supplied.

-keyserver enable | disable | newkey

(Required if you do not specify -usb) Specifies the encryption task that involves encryption keys that are managed by key servers.

-keyserver enable: Enables encryption capability on the system. Use this command when the system has encryption hardware and encryption licenses (for example, the lsencryption value for keyserver_status is set to licensed).
-keyserver disable: Disables the encryption capability of the system. If no encryption key is prepared, this operation is complete and no further action is needed. Do not use this command if an encryption key is prepared or encrypted objects exist.
-keyserver newkey: Generates a new encryption key on the primary key server that is attached the system. You must also specify -key when you specify this parameter.

-key prepare | commit | cancel

(Optional) Manages the creation of a new or replacement (rekey) encryption keys when -usb newkey or -keyserver newkey is specified. There are three stages:

-key prepare: Generates system encryption keys and writes those keys to all system attached USB flash drives or key servers. If there is active encryption key material, confirm that at least one USB flash drive or key server has the current key material. Use this command only when the lsencryption value for usb_rekey or keyserver_rekey is set to no or no_key.
-key commit: Commits the prepared key as the current key. Use this command when the lsencryption value for usb_rekey or keyserver_rekey is set to prepared and the number of USB encryption keys is at least the minimum number required.
-key cancel: Cancels any specified key changes. Use this command when the lsencryptionvalue for usb_rekey or keyserver_rekey is set to prepared.

Description

Use this command to manage the encryption state of the system. You must specify either -usb or -keyserver.

You can use this command can to turn on or turn off USB key encryption or key server encryption (but you cannot disable encryption if there are any encrypted objects). There are four types:

enable, which enables encryption
disable, which disables encryption
validate, which validates encryption key files on all of the USB flash drives currently installed in the system. The lsportusb command should be used to check the results of this command. Refer to lsportusb for more information.
Note: The validate option does not apply to key server encryption.
newkey, which specifies a new key for encryption

You can also perform a rekey of the external USB key or key server key material, which is divided into three stages:

prepare, which generates new keys and sets up the system to change encryption keys during apply
commit, which includes applying new keys (and copying key material)
cancel, which rolls back the key setup that is performed during the prepare and cancels the rekey request

You can use both USB flash drive and key server encryption in parallel on the same system. However, you must configure and administer these encryption methods independently.

An invocation example

chencryption -usb enable

The resulting output:

No feedback

An invocation example

chencryption -usb newkey -key prepare

The resulting output:

No feedback

An invocation example

chencryption -usb newkey -key commit

The resulting output:

No feedback

An invocation example

chencryption -keyserver enable

The resulting output:

chencryption -keyserver newkey -key prepare

An invocation example

chencryption -keyserver newkey -key commit

The resulting output:

No feedback

An invocation example

chencryption -usb validate

The resulting output:

No feedback