A method for encrypting data in a storage system comprising: receiving, at a host-side module executing on a host machine , a data storage write request to store data in a storage pool , the write request including the data to be written, from a client (130-1, ..., 130-n, 140) executing on the host machine ; partitioning, by the host-side module , the received data into one or more data blocks (601 - 604); generating, by the host-side module , one or more fingerprints (611-614) based on the one or more data blocks (601-604); requesting, by the host-side module , encryption information from a storage controller ; receiving, by the host-side module , the encryption information from the storage controller ; compressing, by the host-side module , the one or more data blocks (601-604); generating, by the host-side module , encrypted data by encrypting the compressed one or more data blocks (601-604) using the encryption information; and generating, by the host-side module , one or more clumps of the encrypted data blocks for storage, wherein the one or more clumps are configured to contain a specific number of the encrypted data blocks for storage; generating, by the host-side module , one or more clump fingerprints for the one or more clumps based on the one or more fingerprints (611-614) and packaging the one or more clump fingerprints into the one or more clumps ; sending, by the host-side module , the one or more clumps to a storage controller for storage in a storage node (310 1, ..., 310 N) separate from the host machine for deduplication by comparison of the one or more clump fingerprints of the one or more clumps to one or more clump fingerprints (611-614) stored in the fingerprint index . receiving, at a host-side module executing on a host machine , a data storage write request to store data in a storage pool , the write request including the data to be written, from a client (130-1, ..., 130-n, 140) executing on the host machine ; partitioning, by the host-side module , the received data into one or more data blocks (601 - 604); generating, by the host-side module , one or more fingerprints (611-614) based on the one or more data blocks (601-604); requesting, by the host-side module , encryption information from a storage controller ; receiving, by the host-side module , the encryption information from the storage controller ; compressing, by the host-side module , the one or more data blocks (601-604); generating, by the host-side module , encrypted data by encrypting the compressed one or more data blocks (601-604) using the encryption information; and generating, by the host-side module , one or more clumps of the encrypted data blocks for storage, wherein the one or more clumps are configured to contain a specific number of the encrypted data blocks for storage; generating, by the host-side module , one or more clump fingerprints for the one or more clumps based on the one or more fingerprints (611-614) and packaging the one or more clump fingerprints into the one or more clumps ; sending, by the host-side module , the one or more clumps to a storage controller for storage in a storage node (310 1, ..., 310 N) separate from the host machine for deduplication by comparison of the one or more clump fingerprints of the one or more clumps to one or more clump fingerprints (611-614) stored in the fingerprint index . <EOS>