License:  IBM FlashSystem 900 Model AE3 requires a license for encryption. This license  is supplied by using the Feature Code (FC) AF14 Encryption Enablement. If encryption is  required, validate with IBM marketing or your IBM Business Partner that the license is  ordered with the equipment.  You can activate encryption by using the easy setup wizard during initialization or the Hot Key  Activation process after the FlashSystem 900 Model AE3 is initialized when an encryption  feature code is purchased. Encryption can be done concurrently and do not cause loss of  access to data. If encryption is activated, an encryption key is generated by the system to be  used for access to the system. The processes start a wizard that guides the user through the  process of copying the encryption key to multiple USB keys, multiple SKLM servers, or both.  The IBM FlashSystem 900 Model AE3 supports Encryption Rekey to create encryption keys  that supersede the existing encryption keys. At system start (power on) or to access an encrypted system, the encryption key must  be provided by an outside source so that the IBM FlashSystem 900 Model AE3 can be  accessed. The encryption key is provided by inserting the USB flash drives into a canister, or  by accessing the external SKLM encryption key servers that were created during system  initialization. Key encryption is protected by an Advanced Encryption Standard (XTS-AES) algorithm key  wrap that uses the 256-bit symmetric option in XTS mode, as defined in the IEEE1619-2007  standard. An HMAC-SHA256 algorithm is used to create a hash message authentication  code (HMAC) for corruption detection, and it is additionally protected by a system-generated  cyclic redundancy check (CRC). The differences between the IBM FlashSystem 900 AE2 and the IBM FlashSystem 900  Model AE3 are shown in Figure 2-11. 2.1.14 IBM FlashSystem Model 900 AE2 and Model 900 AE3 differences Encryption technology Accessing an encrypted system Configuring encryption Figure 2-11 Differences between IBM FlashSystem Model 900 AE2 and Model 900 AE3 46  Implementing IBM FlashSystem 900 Model AE3