When using NetApp Volume Encryption (NVE) which type of server is needed to keep encryption...

NetApp Volume Encryption uses a KMIP server when encryption keys must be stored separately from encrypted data. KMIP is the Key Management Interoperability Protocol and is the standard method ONTAP uses to communicate with external key managers. RADIUS is an authentication protocol and does not store encryption keys for NVE. TLS secures communications but is not itself a key management server. TKIP is an older wireless encryption mechanism and is unrelated to ONTAP volume encryption. Separating keys from encrypted data is a core security control because compromise of storage media or data blocks should not also expose the keys required to decrypt them. In ONTAP environments, external key management provides centralized lifecycle control, auditing, and recovery considerations for encrypted volumes. Support engineers must also verify key-manager reachability before enabling encryption because inaccessible keys can prevent encrypted volumes from being brought online. References/topics: NetApp Volume Encryption, external key management, KMIP server configuration, encryption key separation, and ONTAP security architecture.