Brocade Fabric OS Encryption Administrator’s Guide Supporting Key Management Interoperability Protocol (KMIP) Key-Compliant Environments (Supporting Fabric OS v7.1.0) - Manual (Page 187)

Fabric OS Encryption Administrator’s Guide (KMIP) 169
53-1002747-02
Re-exporting a master key
3
Re-exporting a master key
You can export master keys to the key vault multiple times instead of only once. The ability to export
the master key more than once enables you to recover the master key when needed.
When the master key is exported to the key vault for the first time, it is stored with the actual
master key ID. Subsequent exports are provided with additional exported key IDs that are
generated by the Brocade Encryption Switch. Each additional time the master key is exported to the
key vault, a different key ID is saved.
The master key can be recovered from any export using the exported master key ID and the
corresponding passphrase.
The -- show - localEE command shows the actual master key IDs, along with the new master key
IDs. Also shown are all exported master key IDs associated with a given (actual) master key.
NOTE
You will need to remember the exported master key ID and passphrase you used while exporting the
master key ID.
A new subcommand is available to support exporting master key IDs for a given master key.
SecurityAdmin:switch> cryptocfg --show -mkexported_keyids
The following example lists the exported master key IDs for a given master key ID:
SecurityAdmin:switch> cryptocfg --show –mkexported_keyids
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:92
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:92
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:93
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:94
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:95
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:96
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:97
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:98
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:99
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:9a
e3:ae:aa:89:ec:12:0c:04:29:61:9c:99:44:a3:9b:9b
Operation succeeded.
The exported key ID is displayed with the master key ID, as shown in the examples to follow:
Example: Initial master key export
SecurityAdmin:switch> cryptocfg --exportmasterkey
Enter passphrase:
Confirm passphrase:
Master key exported.
MasterKey ID: 1a:e6:e4:26:6b:f3:81:f7:d8:eb:cc:0f:09:7a:a4:7e
Exported Key ID: 1a:e6:e4:26:6b:f3:81:f7:d8:eb:cc:0f:09:7a:a4:7e