lsencryption

Use the lsencryption command to display system encryption information.

Syntax

Read syntax diagramSkip visual syntax diagram lsencryption

Parameters

-delim delimiter
(Optional) Specify a delimiter to separate data in the output.
-nohdr
(Optional) Suppress the headings in the output.

Description

Use this command to display output that is related to the system encryption state.
This table describes possible outputs.
Table 1. lsencryption output
Attribute Value
status Indicates the system USB encryption status.
  • not_supported, which indicates that the system has no supported encryption function.
  • not_licensed, which indicates that the system supports USB encryption but not all licenses are installed.
  • licensed, which indicates that the system has licenses that are installed for all encryption-capable hardware.
  • enabled, which indicates that system encryption by using USB flash drives is working and ready to create encrypted storage.
error_sequence_number Indicates the event log sequence number of any problem that affects encryption. If there is no problem, it is blank.
usb_rekey Indicates the state of the Universal Serial Bus (USB) rekey process.
  • no, which indicates that there is no rekey process ongoing, but keys exist.
  • no_key, which indicates that there is no rekey process and keys do not exist.
  • prepared, which indicates that a rekey process is active and the system prepares a new key that is waiting for this command to be issued: chencryption -usb newkey -key commit.
  • committing, which indicates that a commit is in progress.
usb_key_copies Indicates the number of USB devices that prepared keys are written to.
usb_key_filename Indicates the name of the file that contains the current encryption key.
usb_rekey_filename Indicates the name of the file that contains the current prepared encryption key.
keyserver_status Indicates the encryption status for key server encryption. The values are:
  • not_supported, which indicates that the system has no supported encryption function.
  • not_licensed, which indicates that the system supports key server encryption but not all licenses are installed.
  • licensed, which indicates that the system has licenses that are installed for all encryption-capable hardware.
  • enabled, which indicates that system encryption by using key servers is working and ready to create encrypted storage.
keyserver_rekey Indicates the state of the key server rekey process. The values are:
  • no, which indicates that there is no rekey process ongoing, but keys exist.
  • no_key, which indicates that there is no rekey process and keys do not exist.
  • prepared, which indicates that a rekey process is active and the system prepares a new key that is waiting for this command to be issued: chencryption -keyserver newkey -key commit.
  • committing, which indicates that a commit is in progress.
keyserver_pmk_uid Indicates the UID for the key server.
keyserver_rekey_pmk_uid Indicates the UID (after a rekey process) for the key server.
recovery_key_status Indicates the status for the encryption recovery key. The possible values can be:
  • not_supported
  • not_licensed
  • licensed
  • enabled
recovery_key_rekey Indicates the state of the encryption recovery key re-key process. The possible values can be:
  • no
  • no_key
  • prepared
  • confirmed
  • committing
recovery_key_name Indicates the name of the committed recovery key. The string can be in the recoverykey_<cluster_id_alias>_<key_uid>_<cluster_name> format.
recovery_key_rekey_name Indicates the name of the prepared recovery key. The string can be in the recoverykey_<cluster_id_alias>_<key_uid>_<cluster_name> format.
internal_key_status Indicates the status of the internal key management. The possible values can be:
  • not_supported
  • not_licensed
  • licensed
  • enabled
usb_last_rekey_time Indicates the date and time of the last successful rekey operation for the USB flash drives.
keyserver_last_rekey_time Indicates the date and time of the last successful rekey operation for the key server.
recovery_key_last_rekey_time Indicates the date and time of the last successful rekey operation for the encryption recovery key.
internal_key_last_rekey_time Indicates the date and time of the last successful rekey operation for the internal key.