Rapid Recovery uses AES 256-bit encryption in the Cipher Block Chaining (CBC) mode with 256-bit keys. While using encryption is optional, Quest recommends that you establish an encryption key, and that you protect the passphrase you define.
|
|
Caution: Store the passphrase in a secure location. Without a passphrase, you cannot recover data from encrypted recovery points. |
After an encryption key is defined, you can use it to safeguard your data. Encryption keys can be used by any number of protected machines.
This step describes how to add an encryption key from the Rapid Recovery Core Console. This process does not apply the key to any machines currently being protected on the Core. You can also add an encryption key during the process of protecting a machine. For more information on adding encryption as part of protecting one machine, see Protecting a machine. For more information on adding encryption to two or more machines while initially protecting them, see About protecting multiple machines.
Complete the steps in this procedure to add an encryption key.
- Navigate to the Rapid Recovery Core Console.
- On the icon bar, click
![[More]](/technical-documents/image/f92ad3ca-7a28-4d58-9161-1095866f59a4)
(More) and then select Encryption Keys.
The Encryption Keys page appears.
- Click Add Encryption Key.
The Create Encryption Key dialog box appears.
- In the Create Encryption Key dialog box, enter the details for the key as described in the following table.
Table 83: Create encryption key details.
|
Name |
Enter a name for the encryption key.
Encryption key names must contain between 1 and 64 alphanumeric characters. Do not use prohibited characters and prohibited phrases. |
|
Description |
Enter a comment for the encryption key.
This information appears in the Description field when viewing encryption keys from the Core Console. You can enter up to 254 characters.
Best practice is to avoid using prohibited characters and prohibited phrases. |
|
Passphrase |
Enter a passphrase used to control access.
Best practice is to avoid usingprohibited characters.
|
|
Caution: Record the passphrase in a secure location. Quest Data Protection Support cannot recover a passphrase. Once you create an encryption key and apply it to one or more protected machines, you cannot recover data if you lose the passphrase. | |
|
Confirm passphrase |
Re-enter the passphrase. It is used to confirm the passphrase entry. |
- Click OK.
The dialog box closes and the encryption key you created is visible on the Encryption Keys page.
- If you want to apply the encryption key to a protected machine, see Applying an encryption key from the Protected Machines page.
You can import an encryption key from another Rapid Recovery Core and use that key to encrypt data for a protected machine in your Core. To import the key, you must be able to access it from the Core machine, either locally or through your network. You must also know the passphrase for the encryption key.
Complete the steps in this procedure to import an encryption key.
- Navigate to the Rapid Recovery Core Console.
- On the icon bar, click (More) and then select
![[Encryption Keys]](/technical-documents/image/7985f653-c964-4374-ae4f-ea957ace0e9c)
Encryption Keys.
The Encryption Keys page appears.
- Click
![[Import]](/technical-documents/image/3b91c977-fecc-4787-97de-4529719acc67)
Import.
The File Upload dialog box appears.
- In theFile Upload dialog box, navigate to the network or local directory containing the encryption key you want to import.
For example, navigate to the Downloads folder for the logged-in user.
The key filename starts with "EncryptionKey-," followed by the key ID, and ending in the file extension .key. For example, a sample encryption key name is EncryptionKey-RandomAlphabeticCharacters.key.
- Select the key you want to import, and then click Open.
- In the Import Key dialog box, click OK.
The dialog box closes and the encryption key you imported is visible on the Encryption Keys page. If the encryption key was used to protect a volume before it was exported, the state of the key is Locked.
Encryption keys may contain a state of unlocked or locked. An unlocked encryption key can be applied to a protected machine to secure the backup data saved for that machine in the repository. From a Rapid Recovery Core using an unlocked encryption key, you can also recover data from a recovery point.
When you import an encryption key into a Rapid Recovery Core, its default state is Locked. This is true regardless of whether you explicitly imported the key, or whether the encryption key was added to the Rapid Recovery Core either by replicating encrypted protected machines or by importing an archive of encrypted recovery points.
For encryption keys added to the Rapid Recovery Core by replication only, when you unlock a key, you can specify a duration of time (in hours, days, or months) for the encryption key to remain unlocked. Each day is based on a 24-hour period, starting from the time the unlock request is saved to the Rapid Recovery Core. For example, if the key is unlocked at 11:24 AM on Tuesday and the duration selected is 2 days, the key automatically re-locks at 11:24 AM that Thursday.
|
|
NOTE: You cannot use a locked encryption key to recover data or to apply to a protected machine. You must first provide the passphrase, thus unlocking the key. |
You can also lock an unlocked encryption key, ensuring that it cannot be applied to any protected machine until it is unlocked. To lock an encryption key with a state of Universal, you must first change its type to Replicated.
If an unlocked encryption key is currently being used to protect a machine in the Core, you must first disassociate that encryption key from the protected machine before you can lock it.
Complete the steps in this procedure to unlock a locked encryption key.
- Navigate to the Rapid Recovery Core Console.
- On the icon bar, click (More) and then select Encryption Keys.
The Encryption Keys page appears. The State column indicates which encryption keys are locked.
- Locate the encryption key you want to unlock, click its drop-down menu , and select Unlock.
The Unlock Encryption Key dialog box appears.
- In the dialog box, in the Passphrase text box, enter the passphrase to unlock this key.
- To specify the length of time that the key remains unlocked, in the Duration option, do one of the following:
- To specify that the key remains unlocked until you explicitly lock it, select Until locked manually.
- To specify that the key remains locked for a duration which you configure in hours, days, or months, do the following:
- To specify that the key remains locked until a date and time that you specify, do the following:
When an encryption key state is locked, it cannot be applied to any protected machine until it is unlocked. To lock an encryption key with a type of Universal, you must first change its type to Replicated.
Complete the steps in this procedure to lock an encryption key.
- Navigate to the Rapid Recovery Core Console.
- On the icon bar, click (More) and then select Encryption Keys.
The Encryption Keys page appears. The State column indicates which encryption keys are unlocked, and shows the type for each key.
- Locate the encryption key you want to lock. If its type is Universal, then click its drop-down menu , and select Change the type to Replicated.
The Change Encryption Key Type dialog box appears.
- In the dialog box, confirm that you want to change the key type to Replicated.
- If you successfully changed the encryption key status to Replicated, then click its drop-down menu , and select Lock.
The Lock Encryption Key dialog box appears.
- In the dialog box, confirm that you want to lock the key.
The dialog box closes, and the state of the selected encryption key is now locked.
|
|
NOTE: This option is available for encryption keys added by replication. |
