vania-janet/multiturn-rag-retrieval-data huggingface dataset:
"state" : 1,
"state_description" : "active"
},
"bundle_certs" : true,
"ca" : "lets-encrypt-config",
"dns" : "cloud-internet-services-config",
"key_algorithm" : "RSA2048",
"labels" : "dev", "us-south" ],
"updated_at" : "2022-10-05T21:33:11Z",
"locks_total" : 0,
"name" : "my-public-certificate",
"rotation" : {
"auto_rotate" : true,
"rotate_keys" : true
},
"secret_group_id" : "bfc0a4a9-3d58-4fda-945b-76756af516aa",
"serial_number" : "03:e2:c6:e4:0b:7d:30:e2:e2:78:1b:b9:13:fd:f0:fc:89:dd",
"secret_type" : "public_cert",
"signing_algorithm" : "SHA256-RSA",
"state" : 1,
"state_description" : "active",
"validity" : {
"not_before" : "2020-10-05T21:33:11Z",
"not_after" : "2023-10-05T11:49:42Z"
},
"versions_total" : 1
} ],
"total_count" : 232
}







 ibmcloud secrets-manager secret 

Get a secret and its details by specifying the ID of the secret.

A successful request returns the secret data that is associated with your secret, along with other metadata.
SSL certificates 

Secure Sockets Layer (SSL) is a technology that encrypts traffic between the client application and the server application that is involved in the conversation. This encryption is accomplished through a public key/private key system that uses an SSL certificate.

The SSL certificate contains the server’s public key, dates for which the certificate is valid, a host name for which the certificate is valid and a signature from the Certification Authority that issued it. With this information and some protocol information that is exchanged during the beginning of a session, the client can be reasonably certain that the server is the one to which it is intending to talk.

For more information about SSL certificates, see [Getting started with SSL certificates](https://cloud.ibm.com/docs/ssl-certificates?topic=ssl-certificates-getting-started-tutorial).
Data on nonencrypted storage in an upgraded data center can be encrypted by creating a LUN, then copying the data to the new encrypted LUN with host-based migration. For more information, see [Upgrading existing Block Storage for Classic to enhanced Block Storage for Classic](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-migratestoragemigratestorage).
* Does Block Storage for Classic support SCSI-3 Persistent Reserve to implement I/O fencing for Db2 pureScale?

Yes, Block Storage for Classic supports both SCSI-2 and SCSI-3 persistent reservations.
* What happens to the data when Block Storage for Classic LUNs are deleted?

IBM Cloud® Block Storage for Classic presents Block volumes to customers on physical storage that is wiped before any reuse.

When you delete a Block Storage for Classic volume, that data immediately becomes inaccessible. All pointers to the data on the physical disk are removed. If you later create a new volume in the same or another account, a new set of pointers is assigned. The account can't access any data that was on the physical storage because those pointers are deleted. When new data is written to the disk, any inaccessible data from the deleted volume is overwritten.

IBM guarantees that data deleted cannot be accessed and that deleted data is eventually overwritten and eradicated. Further, when you delete a Block Storage for Classic volume, those blocks must be overwritten before that block storage is made available again, either to you or to another customer.

When IBM decommissions a physical drive, the drive is destroyed before disposal. The decommissioned drives are unusable and any data on them is inaccessible.

Customers with special requirements for compliance such as NIST 800-88 Guidelines for Media Sanitization can perform the data sanitization procedure before they delete their storage.
* What happens to the drives that are decommissioned from the cloud data center?

When drives are decommissioned, IBM destroys them before they are disposed of. The drives become unusable. Any data that was written to that drive becomes inaccessible.
* I cannot cancel a Block Storage for Classic volume because the Cancel action in the Cloud console is disabled.
You have a choice of whether to allow Key Protect to wrap your data or whether you want to provide your own base64 encoded plaintext and additional authentication data (AAD), as needed, to wrap the data. Note that if you choose to provide your own plaintext and AAD, you will have to provide it when unwrapping your data. If you do not have experience creating AAD and base 64 encoded plaintext, the recommended practice is to allow Key Protect to wrap your data by leaving the Wrap key for me option selected.
7. Click Wrap Key button.







 Wrapping keys by using the API 

You can protect a specified data encryption key (DEK) with a root key that you manage in Key Protect.

[After you designate a root key in the service](https://cloud.ibm.com/docs/key-protect?topic=key-protect-create-root-keys), you can wrap a DEK with advanced encryption by making a POST call to the following endpoint.

https://<region>.kms.cloud.ibm.com/api/v2/keys/<keyID_or_alias>/actions/wrap



1. [Retrieve your authentication credentials to work with keys in the service.](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api)
2. Copy the key material of the DEK that you want to manage and protect.

If you have manager or writer privileges for your Key Protect instance, [you can retrieve the key material for a specific key by making a GET /v2/keys/<keyID_or_alias> request](https://cloud.ibm.com/docs/key-protect?topic=key-protect-view-keysview-keys-api).
3. Copy the ID of the root key that you want to use for wrapping.
4. Run the following curl command to protect the key with a wrap operation.
Note: The key ring ID of keys that are created without an x-kms-key-ring header is: default. or more information, see [Grouping keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-grouping-keys). 
 correlation_ID Optional.The unique identifier that is used to track and correlate transactions. 
 data_key Optional.The key material of the DEK that you want to manage and protect. The plaintext value must be base64 encoded. For more information on encoding your key material, see [Encoding your key material](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keyshow-to-encode-root-key-material). To generate a new DEK, omit the plaintext attribute. The service generates a random plaintext (32 bytes), wraps that value, and then returns both the generated and wrapped values in the response. The generated and wrapped values are base64 encoded and you will need to decode them in order to decrypt the keys. 
 additional_data Optional.The additional authentication data (AAD) that is used to further secure the key. Each string can hold up to 255 characters. If you supply AAD when you make a wrap call to the service, you must specify the same AAD during the subsequent unwrap call.Important: The Key Protect service does not save additional authentication data. If you supply AAD, save the data to a secure location to ensure that you can access and provide the same AAD during subsequent unwrap requests. 



Your wrapped data encryption key, containing the base64 encoded key material, is returned in the response entity-body. The response body also contains the ID of the key version that was used to wrap the supplied plaintext. The following JSON object shows an example returned value.

{
"ciphertext": "eyJjaXBoZXJ0ZXh0IjoiYmFzZTY0LWtleS1nb2VzLWhlcmUiLCJpdiI6IjRCSDlKREVmYU1RM3NHTGkiLCJ2ZXJzaW9uIjoiNC4wLjAiLCJoYW5kbGUiOiJ1dWlkLWdvZXMtaGVyZSJ9",
"keyVersion": {
"id": "02fd6835-6001-4482-a892-13bd2085f75d"
}
}
* Satellite: See [Satellite worker nodes](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionworker-encryption-satellite).



4. Cluster secrets: When you deploy your app, don't store confidential information, such as credentials or keys, in the YAML configuration file, configmaps, or scripts. Instead, use [Kubernetes secrets](https://kubernetes.io/docs/concepts/configuration/secret/), which are base64 encoded by default. To enable encryption of your Kubernetes secrets, [enable a key management service (KMS) provider](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) for your cluster.

In clusters that run Red Hat OpenShift on IBM Cloud 4 or later, you can [deploy containers from an encrypted image](https://cloud.ibm.com/docs/openshift?topic=openshift-imagesencrypted-images).
5. Persistent storage encryption: You can choose to store data by [setting up file, block, object, or software-defined Portworx persistent storage](https://cloud.ibm.com/docs/openshift?topic=openshift-storage-plan). If you store your data on file or block storage, your data is automatically encrypted at rest. If you use object storage, your data is also encrypted during transit. With Portworx, you can choose to [set up volume encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-storage_portworx_encryption) to protect your data during transit and at rest. The IBM Cloud infrastructure storage instances save the data on encrypted disks, so your data at rest is encrypted.







 Understanding Key Management Service (KMS) providers
<br><br> * [Creating a Continuous Delivery service instance](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-create_cd_service)<br> * [Protecting your personal data when you use the Professional plan](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-cd_data_securitycd_professional_plan)<br><br><br> 







 Understanding your integration 

When you integrate a supported service with Hyper Protect Crypto Services, you enable [envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption) for that service. With this integration, you can use a root key that you store in Hyper Protect Crypto Services to wrap the data encryption keys that encrypt your data at rest.

For example, you can create a root key, manage the key in Hyper Protect Crypto Services, and use the root key to protect the data that is stored across different cloud services.

The following diagram illustrates the scene of integrating Hyper Protect Crypto Services with two services.

Zoom

![The diagram shows a contextual view of your Hyper Protect Crypto Services integration.](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/hpcs-integrations.svg)

Figure 1. Integrating Hyper Protect Crypto Services

Behind the scenes, the Hyper Protect Crypto Services key management service API drives the envelope encryption process.

The following table lists the API methods that add or remove envelope encryption on a resource.



Table 8. Describes the Hyper Protect Crypto Services key management service API methods

 Method Description 

 POST /keys/{root_key_ID}?action=wrap [Wrap (encrypt) a data encryption key.](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-wrap-keys)
Tutorial: Creating and importing encryption keys 

Learn how to create, encrypt, and bring your encryption keys to the cloud by using Key Protect.

As a security professional for your organization, you're always looking for ways to enhance the security of your at rest data on the cloud.

To comply with strict data governance and regulatory audit requirements, you want to integrate your apps with a key management service that offers fine-grained access control to encryption keys, audit trail capabilities, and flexible options for uploading encryption keys that you generate on-premises.

With Key Protect, you can create encryption keys by using your internal key management system, and then upload those keys for use on the cloud.

You can choose from [different options for uploading keys](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keysplan-ahead) based on your ongoing security needs. As you manage the lifecycle of encryption keys, you control access to resources by using Cloud Identity and Access Management, and you monitor API activity to the service with Activity Tracker.

In this tutorial, you use an [import token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keysusing-import-tokens) to upload an encryption key to Key Protect. To learn more about your options for importing keys to Key Protect, see [Planning ahead for importing key material](https://cloud.ibm.com/docs/key-protect?topic=key-protect-importing-keysplan-ahead).

To learn about importing a key without an import token, see [Importing a root key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-import-root-keys)



 Objectives 

This tutorial walks you through creating and securely importing encryption keys into the Key Protect service. It's intended for users who are new to Key Protect, but who might have some familiarity with key management systems. The following steps should take about 20 minutes to complete.



* Setting up the Key Protect CLI
* Preparing your Key Protect service instance to begin importing keys
responseData.keyRingId The ID of the key ring if a key ring is specified in the request or in API methods where the key ID (or alias) is in the path of the request<br><br>URI<br><br>. 







 Key action events 

Due to the sensitivity of the information for an encryption key, when an event is generated as a result of an API call to the Key Protect service, the event that is generated does not include detailed information about the key, such as the payload and encrypted nonce.

The responseData.keyState field is an integer and corresponds to the Pre-activation = 0, Active = 1, Suspended = 2, Deactivated = 3, and Destroyed = 5 values. For more information on key states, see [Key states and transitions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-stateskey-transitions).



 Create Key 

The following fields include extra information:



* The requestData.keyType field includes the type of key that was created.
* The responseData.keyId field includes the unique identifier associated with the key.
* The responseData.keyVersionId field includes the unique identifier of the current key version used to wrap input ciphertext on wrap requests.
* The responseData.keyVersionCreationDate field includes the date that the current version of the key was created.
* The responseData.keyState field includes the integer that correlates to the state of the key.
* The responseData.expirationDate includes the date that the key will expire on.







 Delete Key 

The following field includes extra information:



* The responseData.keyState field includes the integer that correlates to the state of the key.







 Expire Key 

The following field includes extra information:



* The requestData.keyType field includes the type of key that was created.
* The responseData.keyId field includes the unique identifier associated with the key.
* The requestData.expirationDate field includes the date that the key expired on.
* A customer root key that encrypts volume, share, and custom image passphrases with envelope encryption, which creates a wrapped DEK or WDEK. Root keys are customer-managed from KMS instances (Key Protect or Hyper Protect Crypto Services), and stored and managed securely within the KMS instance. The root key also unwraps (decrypts) the WDEK, providing access to your encrypted data.







 Supported key management services 

Two IBM key management services (KMS) are available for customer-managed encryption, Key Protect and Hyper Protect Crypto Services (available in certain [regions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regionsregions)). These services use a common key provider API to provide a consistent approach for managing your encryption keys.

Table 1 describes these services:



Table 1. Available key management service options

 Key Management Service HSM Encryption Certification Description 

 [Key Protect](https://cloud.ibm.com/docs/key-protect/concepts?topic=key-protect-getting-started-tutorial) FIPS 140-2 Level 3 compliance With A multi-tenant KMS, you can import or create your root keys and securely manage them. 
 [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) FIPS 140-2 Level 4 compliance Highest level of security. A single-tenant KMS and hardware security module (HSM) that is controlled by you. Import or create your root keys and securely manage them. Create an HSM master key to encrypt the content of key storage, including root keys. Only you have access to your keys and data. 



You might see Key Protect being described as BYOK, "bring your own key" and Hyper Protect Crypto Services as KYOK, or "keep your own key". Key Protect and Hyper Protect Crypto Services are similar services.





 Envelope encryption 

Root keys serve as key-wrapping keys and are an important part of envelope encryption.
SSL certificates 

Secure Sockets Layer (SSL) is a technology that encrypts traffic between the client application and the server application that is involved in the conversation. This encryption is accomplished through a public key or private key system by using an SSL certificate.

The SSL certificate contains the server’s public key, dates for which the certificate is valid, a hostname for which the certificate is valid, and a signature from the certificate authority that issued it. With this information and some protocol information from the beginning of a session, you can be reasonably certain that the server is the one to which it is intending to talk.

For more information about SSL certificates, see [Getting started with SSL certificates](https://cloud.ibm.com/docs/ssl-certificates?topic=ssl-certificates-getting-started-tutorialgetting-started-tutorial).
Using Hyper Protect Crypto Services PKCS 11 for IBM Db2 native encryption 

IBM Db2® native encryption protects key database files and database backup images from inappropriate access while they are stored on external storage media. The database system automatically encrypts and decrypts data when it is used by authorized users and applications. Typically, database users do not need to be aware of native encryption and database client applications do not need to be adapted specifically.

Db2 native encryption uses a two-tiered key hierarchy: Data is encrypted with a data encryption key (DEK). The DEK is encrypted with a master key and is stored in encrypted form with the database or the backup image. A unique DEK is generated by Db2 for each encrypted database and for each encrypted backup.

A master key is used to encrypt a DEK. Each encrypted database is associated with one master key at one time.

One important question when you plan for Db2 native encryption is where you keep the master key and how you secure it.



 Objectives 

This tutorial shows how you can keep complete and exclusive control of your master keys by storing them in IBM Cloud® Hyper Protect Crypto Services. For this purpose, you need to use the PKCS #11 integration feature of Hyper Protect Crypto Services.

With this tutorial, you are going to implement the setup that is depicted in the following illustration.

Zoom

![IBM Db2 default encryption with the standard PKCS #11 API](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto/images/pkcs-db2.svg)

Figure 1. IBM Db2 default encryption with the standard PKCS #11 API

In this setup, Db2 is to call operations to manage the master keys on the Hyper Protect Crypto Services PKCS #11 library. The Hyper Protect Crypto Services PKCS #11 library interacts with your Hyper Protect Crypto Services instance, which provides the best of class technology for storing and managing your master keys.
At-rest encryption All data that is stored in an IBM Cloudant instance is encrypted at rest by using LUKS1 with 256-bit Advanced Encryption Standard (AES-256). By default, IBM Cloudant manages the encryption keys for all environments. If you require bring-your-own-key (BYOK) encryption for encryption-at-rest, you enable it by using your encryption key that is stored in an IBM Cloud Key Protect instance. IBM Cloudant supports the BYOK feature for new IBM Cloudant Dedicated Hardware plan instances that are deployed in all regions. For more information, see the [Creating an IBM Cloudant Dedicated Hardware plan instance](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-creating-and-leveraging-an-ibm-cloudant-dedicated-hardware-plan-instance-on-ibm-cloud) tutorial for details on how to choose BYOK at provisioning time. 
 In-flight encryption All access to IBM Cloudant is encrypted by using HTTPS. 
 Client-side encryption Customers can use client-side encryption to ensure that the data protection is controlled by the data owner and the data is never visible to the service provider. 
 TLS IBM Cloudant requires the use of TLS 1.2+. IBM Cloudant strongly recommends that you do not pin certificates in your application. Certificates renew regularly, at least annually, and intermediate and root certificates could change when they do. IBM Cloudant does not send out notifications before certificate renewals. We recommend that you keep your certificate truststore up to date with the latest root certificates. IBM Cloudant acquires its certificates from DigiCert. You can find their root certificates on the [DigiCert Trusted Root Authority Certificates](https://www.digicert.com/kb/digicert-root-certificates.htm) page. IBM Cloudant sends a notification if we move to a different certificate authority. 
 Endpoints All IBM Cloudant instances are provided with external endpoints that are publicly accessible. Dedicated Hardware environments created after 1 January 2019 outside of the EU-managed cloud also add internal endpoints for all Standard plan instances deployed on them.
Data Protection Services 

Data Security Broker offers Data Protection services which enables the provisioning of Data Security Broker Manager and Data Security Broker Shield. It also helps in configuring encryption or decryption rules against the IBM Cloud Databases such as PostgreSQL to encrypt and decrypt the database records or columns on the fly. It also helps in migrating the existing database records, apply record or column level encryption rules.

Data Security Broker supports two types of Data Protection services. They are:



1. [Data Encryption](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_encrypt_data)
2. [Data Masking](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_masking)





 Procedure 

After you have completed setting up and configuring the Data Security Broker Manager, you can perform standard encryption or data masking by defining a Data Protection policy. Ensure that you complete the steps below before you can use the data protection services offered by Data Security Broker.



1. You must add a Keystore, so that the Data Security Broker Manager can access and create data encryption keys (DEKs) that is used to protect your data. For more information, see [Adding a Keystore in Data Security Broker Manager](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_add_keystore).
2. Connect to a database in the Data Security Broker Manager. For more information, see [Connect to a Datastore in Data Security Broker Manager](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_add_db).
3. Enroll an Application in Data Security Broker Manager. For more information, see [Enrolling an application in Data Security Broker Manager](https://cloud.ibm.com/docs/security-broker?topic=security-broker-sb_enroll_app).
4. Assign and customize a Default Data Protection Policy.