Global Storage Forum

Global Storage Forum

Connect, collaborate, and stay informed with insights from across Storage

 View Only

Unable to create FlashSystem USB Encryption Key via GUI

By Shawn Bodily posted yesterday

  

Over a few month period from the end of 2024 until March or so of 2025 I performed ~5 IBM Flashsystem installs. The models were mostly FS5300 but this problem wasn’t limited to just that model. Which is means it most likely was a software code level issue, but yet I’ve never been able to find a known issue/defect about it.

Long story short, when creating the USB encryption keys the GUI would never acknowledge the USB keys were inserted to continue. Tried several different browsers and USB keys and none of seemed to matter either. So ultimately the only way we were able to do so was via the CLI shared below. If anybody knows an exact level this affects I would gladly update this article to include it. Drop me an email at sbodily@cleartechnologies.net

The steps below are available at https://www.ibm.com/docs/en/flashsystem-9×00/9.1.0?topic=drives-enabling-encryption-usb-flash

To enable the encryption that uses USB flash drives, enter the following command:

chencryption -usb enable

Verify via the lsencryption command output as italicized below.

  • status enabled
  • error_sequence_number….

Insert the USB keys. Enter the following command to prepare a new USB master key:

chencryption -usb newkey -key prepare

The new key has been created successfully when the usb_rekey_filename field shows the name of the new key upon executing lsencryption command as shown below in italics.

  • status enabled
  • error_sequence_number
  • usb_rekey no
  • usb_key_copies 4
  • usb_key_filename encryptionkey_alphanum_alphanum_fsname
  • usb_rekey_filename
  • keyserver_status licensed
  • keyserver_rekey no_key
  • keyserver_pmk_uid
  • keyserver_pmk_rekey_uid
  • recovery_key_status enabled
  • recovery_key_rekey no
  • recovery_key_name recoverykey_alphanum_alphanum_fsname
  • recovery_key_rekey_name

After all copies are completed, run the following command to complete the enablement process:

chencryption -usb newkey -key commit

2 comments
13 views

Permalink

https://community.ibm.com/community/user/blogs/shawn-bodily/2025/11/20/create-usb-key-viacli

Comments

Shawn Bodily
4 hours ago

We tried each of the 2 pair of USBs that came with the Flash unit and a couple others we just had on us and got no joy from any of them as far as the GUI every acknowledging they were there. We would back out of the screen and go back to it, try again, nada.


We had it happen on 3-4 installs in a row over probably the same amount of months and then not anymore since then.

Leon Olson
5 hours ago

We had the same issue on a FS5045 yesterday but finally got it to work. Here is what we did: 

Inserted two USBs into flash. The USBs were not recognized.

Removed USBs and plugged into PC. One of the USBs and observed one had a file called SAINFO.txt (output of CLI command). Left the file there.  

Inserted two different USBs into the flash. USBs were recognized and encryption keys written to USBs. 

Inserted the first pair of USBs that didn't work. This time the keys were written to that pair successfully.