Workflow for changing the encryption key
To change the encryption key for existing encrypted data, you must migrate the data to an encrypted parity group that has a different encryption key.
Use the following process to change the encryption key for encrypted data:
- Create a new parity group.
- Enable encryption with a new data encryption key. For details, see Enabling data encryption.
- Format the LDEVs in the encrypted parity group. For instructions, see Formatting all LDEVs in a parity group.
- Migrate the source data to the new target LDEVs in the encrypted parity group.
When a drive is replaced, the data encryption keys that are allocated to that drive are deleted, and new data encryption keys are allocated when the new drive is added.
