vania-janet/multiturn-rag-retrieval-data huggingface dataset:
If bucket creation fails with a 400 Bad Request error with the message The Key CRN could not be found, ensure that the CRN is correct and that the service to service authorization policy exists.

In the Buckets listing, the bucket has a View link under Attributes where you can verify that the bucket has a Key Protect key enabled.

Note that the Etag value returned for objects encrypted using SSE-KP will be the actual MD5 hash of the original decrypted object.

It is also possible to use [the REST API](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-compatibility-api-bucket-operationscompatibility-api-key-protect) or SDKs ([Go](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-using-gogo-examples-kp), [Java](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-javajava-examples-kp), [Node.js](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-nodenode-examples-kp), or [Python](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-pythonpython-examples-kp)).





 Key lifecycle management 

Key Protect offers various ways to manage the lifecycle of encryption keys. For more details, see [the Key Protect documentation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-states).



 Rotating Keys 

Key rotation is an important part of mitigating the risk of a data breach. Periodically changing keys reduces the potential data loss if the key is lost or compromised. The frequency of key rotations varies by organization and depends on a number of variables, such as the environment, the amount of encrypted data, classification of the data, and compliance laws.
The result of your API request can vary depending on the implicit state such as session state and user login state. In the stateful case, data is stored on the host. Stateless interface. The result of your API request always stays the same. In the stateless case, no data is stored on the host. 
 Prior installation You need to install the PKCS #11 library on your local workstation first to access the Hyper Protect Crypto Services cloud HSM. No extra installation is needed to access the Hyper Protect Crypto Services cloud HSM. 
 Application migration If your applications use the standard PKCS #11 API, you do not need to modify your existing applications specifically for EP11 or gRPC. In order to use the GREP11 API, you need to make sure that your applications are developed based on the EP11 requirements and gRPC specifications. 
 Authentication and access management The PKCS #11 library has a set of standard user types for authentication. You need to define these user types in an independent configuration file and assign different user types the corresponding IBM Cloud Identity and Access Management (IAM) roles for access management. For more information, see <br><br>[Best practices for setting up PKCS #11 user types](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-access). The GREP11 API uses the standard IAM roles to define the corresponding access. For more information, see [Managing user access](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-access). 
 Additional configuration file Required. You need to configure all of the parameters that include user roles in this file to ensure the successful deployment of the PKCS #11 library. For more information, see the [configuration file template](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-apistep3-setup-configuration-file). Not required.
"certificate": "-----BEGIN CERTIFICATE-----nMIICWzCCAcQCC...(redacted)",
"private_key": "-----BEGIN PRIVATE KEY-----nMIICdgIBADANB...(redacted)",
"intermediate": "-----BEGIN CERTIFICATE-----nMIICUzHHraOa...(redacted)",
"labels": [
"dev",
"us-south"
]
}'
Show more

Order a public SSL/TLS certificate and assign it to the default secret group.

curl -X POST "https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/public_cert/secrets" -H 'Accept: application/json' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d '{
"name": "test-public-certificate-in-group",
"description": "Extended description for my secret.",
"ca": "my-configured-certificate-authority",
"dns": "my-configured-dns-provider",
"common_name": "example.com",
"alt_names": [
"www.example.com"
],
"labels": [
"dev",
"us-south"
],
"bundle_certs": false,
"key_algorithm": "RSA2048",
"rotation": {
"auto_rotate": false,
"rotate_keys": false
}
}'
Show more

Order a public SSL/TLS certificate and assign it to an existing secret group.

curl -X POST "https://{instance_id}.
Your encryption key is now saved in a file called PlainTextKey.bin. Continue to the next step.







 Step 6. Encrypt the nonce 

To verify that the bits we receive are exactly the same as the bits that you send as part of a request, Key Protect requires nonce verification when you upload the symmetric key to the service.

In cryptography, a nonce serves as a session token that checks the originality of a request to protect against malicious attacks and unauthorized calls. By using the same nonce that was distributed by Key Protect, you help to ensure that your request to upload a key is valid. The nonce value must be encrypted by using the same key that you want to import into the service.

To encrypt the nonce value:



1. Encode the key that you generated in the previous step, and set the encoded value as an environment variable.

KEY_MATERIAL=$(base64 PlainTextKey.bin)
2. Gather the nonce value that you retrieved in step 4.

NONCE=$(jq -r '.nonce' getImportTokenResponse.json)
3. Execute the following to encrypt the nonce value with the encryption key that you generated in step 5. Then, save the response to a file called EncryptedValues.json.

ibmcloud kp import-token nonce-encrypt -k $KEY_MATERIAL -n $NONCE --output json > EncryptedValues.json
4. Optional: Inspect the contents of the JSON file by using jq as shown.

jq '.' EncryptedValues.json

The output displays the values that you need to provide for the next step. The following snippet shows example output with truncated values.

{
"encryptedNonce": "DVy/Dbk37X8gSVwRA5U6vrHdWQy8T2ej+riIVw==",
"iv": "puQrzDX7gU1TcTTx"
}
3. Enter credentials for Server1 to log in to the vault for Server1.
4. Click Load Computers, this action displays the servers that are attached to the vault location.
5. Click Save.
6. When prompted, click Yes to confirm the reregistration of the vault.







 Running the backup job from Server1 as the restore job on Server2 



1. Click Jobs.

You might need to refresh the page to see the jobs that are defined on Server1 as accessible and synchronized under the Server2 Jobs tab.
2. From the Action menu, select Restore.
3. Enter the encryption password.
4. The Restore window appears. By default, it displays the most recent safe set. To choose a different date, click the Calendar icon, and view other safe sets.
5. Select the files and directories that you want to include. Then, click Include to save your choices.

Default restore options place the files in their original location. If files exist in the destination folder with the same name, the incoming file is renamed. These options can be changed and alternative restore location can be selected from Restore Destination options.
6. When your restore set is configured the way that you want it, click Apply Now.
7. Then, click Run Restore.
8. The files are restored when the Status displays Restore completed on the Process Details screen. Click Close to close the window and return to the main Cloud Backup Portal screen.







 Verifying the restore 



1. Connect to the root of Server2 through ssh.
2. List the files and all directory entries in a long format.

ls -la
3. Compare the output.







 Resuming normal backup schedule. 



1. When the restore is complete, remove the registration information of server1, where the data was restored from.
2. Enter the current server2 registration and enable Schedule tasks.
If you're using an integrated Cloud Service that supports restoring access to a disabled root key, the service may take up to a maximum of 4 hours before access to the root key's associated data is restored.

After access to the associated data is restored, a corresponding enable event is displayed in the IBM Cloud Activity Tracker web UI. The enable event indicates the key has been restored (and is now enabled) and the key can be used for encrypt and decrypt operations, such as wrap, unwrap, and rewrap.

ibmcloud kp key enable <KEY_ID_OR_ALIAS> -i <INSTANCE_ID> [ --key-ring KEY_RING_ID]



 Examples 

This is an example of kp key enable.

 create a root key
$ ibmcloud kp key create my-root-key --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"extractable": false,
"state": 1,
"crn": "crn:v1:bluemix:public:kms:us-south:a/ea998d3389c3473aa0987652b46fb146:390086ac-76fa-4094-8cf3-c0829bd69526:key:264fadc3-7667-4b25-916e-5825fe70de0b"
}

 show key details - a state of "1" is "active"
$ ibmcloud kp key show 264fadc3-7667-4b25-916e-5825fe70de0b --output json

{
"id": "264fadc3-7667-4b25-916e-5825fe70de0b",
"name": "my-root-key",
"algorithm": "aes",
"activation_date": "P5Y1M1W2D",
"expiration_date": "P1Y2M1W4D",
"state": "active"
},
"description": "IBM CLOUD key template description",
"created_at": "2022-03-09T15:40:52Z",
"updated_at": "2022-03-09T15:40:52Z",
"created_by": "IBMid-1308197YB4",
"updated_by": "IBMid-1308197YB4",
"keystores": [
{
"group": "Production",
"type": "ibm_cloud_kms"
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/templates/ada4293c-07ed-4903-b3ee-419bd1a05fde"
}







 hpcs uko key-template-update 

Update attributes of a key template.

ibmcloud hpcs uko key-template-update --id ID --uko-vault UKO-VAULT --if-match IF-MATCH [--keystores KEYSTORES] [--description DESCRIPTION] [--key KEY]



* Command options

--id (string)
: Required. The UUID of the template. You can use the ibmcloud hpcs uko key-templates command to retrieve the UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko key-templates command to retrieve the UUID.

--if-match (string)
: Required. The precondition of the update, which is the value of the ETag from the header on a GET request.
For more examples of PII, see section 2.2 of the [NIST Special Publication 800-122](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-122.pdf).

A successful POST /v2/keys response returns the ID value for your key, along with other metadata. The ID is a unique identifier that is assigned to your key and is used for subsequent calls to the Hyper Protect Crypto Services key management service API.
3. Optional: Verify that the key was created by running the following call to get the keys in your Hyper Protect Crypto Services service instance.

curl -X GET 
https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys 
-H 'accept: application/vnd.ibm.collection+json' 
-H 'authorization: Bearer <IAM_token>' 
-H 'bluemix-instance: <instance_ID>' 
-H 'correlation-id: <correlation_ID>' 







 What's next 

To find out more about programmatically managing your keys, [check out the Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
* Once retrieved, the wrapped DEK can be stored on the local file system, and unwrapped only when the key is needed for some file system operation (mounting, encryption, etc).



* [Unwrapping a wrapped key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-unwrap-keys&interface=ui)
* [Unwrapping a wrapped key via the API](https://cloud.ibm.com/apidocs/key-protectunwrapkey)





If the root key is rotated or for some other reason an update is needed to the wrapped DEK, the previous API call returns the new DEK also. Store this new DEK and use it for future operations.

For more information about key management (rotation, deletion, auditing), see the Key Protect [Getting started tutorial](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial) and the [API reference](https://cloud.ibm.com/apidocs/key-protect).





 Block Storage encryption with LUKS 

You can use LUKS to encrypt Block Storage volumes. For more information, see [Achieving full disk encryption with LUKS in RHEL](https://cloud.ibm.com/docs/BlockStorage?topic=BlockStorage-LUKSencryption). Once the LUKS volume is mounted, key management is done via cryptsetup.



 LUKS Key Slots 

LUKS has 8 key slots.

[root@classic-byok-poc02 ] blkid | grep LUKS
/dev/sda: UUID="6e515660-7db7-41df-9b48-47d1489c7711" TYPE="crypto_LUKS"
/dev/mapper/3600a09803830564e455d4f3155527337: UUID="6e515660-7db7-41df-9b48-47d1489c7711" TYPE="crypto_LUKS"
* [Connecting to external keystores](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-connect-external-keystores)
* [Creating and installing managed keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-managed-keys)







 28 February 2022 

Limited availability: Using Unified Key Orchestrator to manage and orchestrate keys in a multicloud environment
: Unified Key Orchestrator is a public cloud control plane for multicloud and hybrid cloud key orchestration. As part of the IBM Cloud® Hyper Protect Crypto Services, it provides key lifecycle management according to NIST recommendations and secure transfer of keys to internal keystores in the service instance or external keystores.

With Unified Key Orchestrator, you can connect your service instance to keystores in IBM Cloud and third-party cloud providers, back up and manage keys by using a unified system, and orchestrate keys across multiple clouds.

The following topics can help you get started with Unified Key Orchestrator:



* [Introducing Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-uko)
* [FAQs: Hyper Protect Crypto Services with Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-uko)
* [Getting started with Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started)
* [Monitoring the lifecycle of encryption keys in Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-key-states)
* [Creating vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-vaults)
[Log in to the IBM Cloud console](https://cloud.ibm.com/).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services.
4. On the KMS keys page, use the Keys table to browse the keys in your service.
5. To renotify the protected resources of a specific root key, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/action-menu-icon.svg) to open a list of options for the key and select Synchronize associated resources.
6. On the View associated resources page, click Synchronize.







 Syncing associated resources with the API 

You can renotify associated IBM cloud services of your Hyper Protect Crypto Services root key's lifecycle event by using the Hyper Protect Crypto Services API.

You can initiate the renotification of a key lifecycle event by making a POST call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/actions/sync



1. [Retrieve your authentication credentials to work with the API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).
2. Initiate a manual data synchronization request by running the following curl command.

$ curl -X POST "https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/actions/sync" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>"

Replace the variables in the example request according to the following table.



Table 1.
* [Post-quantum cryptography support](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-introgrep11-support-post-quantum)







 About key rotation - Standard Plan 

[Master key rotation - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-master-key-rotation-intromaster-key-rotation-intro)



* [How master key rotation works](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-master-key-rotation-introhow-master-key-rotation-works)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-master-key-rotation-intromaster-key-rotation-next)



[Root key rotation - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-root-key-rotation-introroot-key-rotation-intro)



* [Comparing your root key rotation options](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-root-key-rotation-introcompare-key-rotation-options)
* [How root key rotation works](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-root-key-rotation-introhow-root-key-rotation-works)
* [Frequency of root key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-root-key-rotation-introrotation-frequency)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-root-key-rotation-introroot-key-rotation-next)









 Understanding Hyper Protect Crypto Services with Unified Key Orchestrator Plan
"offset": 0,
"first": {
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_key/5295ad47-2ce9-43c3-b9e7-e5a9482c362b/associated_resources?limit=20"
},
"last": {
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_key/5295ad47-2ce9-43c3-b9e7-e5a9482c362b/associated_resources?limit=20&offset=0"
},
"previous": {
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys?offset=80"
},
"next": {
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys?offset=120"
},
"associated_resources": [
{
"vault": {
"id": "5295ad47-2ce9-43c3-b9e7-e5a9482c362b",
"name": "Test Vault Name",
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/vaults/5295ad47-2ce9-43c3-b9e7-e5a9482c362b"
},
"managed_key": {
"id": "93777bca-baef-4070-b9b5-a2e6079df1b4",
"name": "My Managed Key",
For more information, see [Adding an NFS backup job](https://onlinehelp.evault.com/HelpFiles/LinuxAgent/10676.htm?TocPath=Server%2520Backup%2520User%2520Guide%257CAdd%2520and%2520edit%2520backup%2520jobs%257C_____10).

NFS Backups are not supported in Windows.





 Can I see what is backed up and sent to the vault when my agent is offline? 

Yes. Backup job results can be obtained from the /opt/BUAgent/xlogcat utility.

First, go to the directory of the Backup Agent.

cd /opt/BUAgent

Then, use the following syntax to show all backup job results.

for i in $(ls -d /); do echo "backup history of $i"; find $i -name ".XLOG" ! -name "Agent" -print -exec /opt/BUAgent/xlogcat {} ; | grep -A 17 "errors encountered"; done

backup history of test/
11-May 19:30:36 -0500 BKUP-I-00001 errors encountered: 0 11-May 19:30:36 -0500 BKUP-I-00002 warnings encountered: 0
11-May 19:30:36 -0500 BKUP-I-00003 files/directories examined: 108
11-May 19:30:36 -0500 BKUP-I-00004 files/directories filtered: 104
11-May 19:30:36 -0500 BKUP-I-00006 files/directories deferred: 0
11-May 19:30:36 -0500 BKUP-I-00007 files/directories backed-up: 4
11-May 19:30:36 -0500 BKUP-I-00008 files backed-up: 2
11-May 19:30:36 -0500 BKUP-I-00009 directories backed-up: 2
If you want to remove a specific safeset, create a [support case](https://cloud.ibm.com/unifiedsupport/supportcenter) so that the IBM Cloud Backup Admins can erase it on the backend.

When a Backup deletion request is submitted to the vaults, the data is automatically deleted from the associated vaults. Because backup deletion requests are submitted and processed by the vaults immediately, backup deletion requests cannot be canceled.

Backup data deletion is permanent. After the data is deleted from vaults, it cannot be recovered or restored.
* What happens to backups when the Backup service is canceled? Can you keep the backups for later use and restore to another server?

No. When the Backup service is canceled, your vault with the backed-up data is deleted. You can't log in to the Cloud Backup Portal with the canceled credentials either. For more information, see [Canceling the IBM Cloud Backup service](https://cloud.ibm.com/docs/Backup?topic=Backup-cancelBackup).



IBM Cloud Data Transfer Service



* What is Data Transfer Service?

This service allows authorized users (generally the account's administrator) to send compatible devices to one of the IBM Cloud® data centers to be connected directly to the account's network. The device is housed in a dedicated rack and is mounted as an iSCSI target for two weeks. During that period, the administrator can access the device on the network to use it with other devices and services on the account. After the two-week period, an extension can be requested to keep the device connected to the network. Otherwise, the device is either returned to the party specified in the request, or the device is destroyed onsite.
* Can a device for data transfer be sent internationally?

Hardware can be sent both domestically and internationally to any of the IBM Cloud® data centers. However, you as the Client are responsible for the meeting the following requirements.



* Ensuring that no import or export license is required to ship the Device to the IBM® data center, or to return it to Client (if applicable).
"id": "ea7b6b27-d71b-4fe9-bbfe-309c7ca713a6",
"label_in_keystore": "IBM CLOUD KEY",
"type": "secret_key",
"keystore": {
"group": "Production",
"type": "ibm_cloud_kms"
}
}
],
"href": "https://uko.us-south.hs-crypto.cloud.ibm.com:9549/api/v4/managed_keys/3dab42dc-6941-4841-8d27-4dabcc5aa09e"
}







 hpcs uko associated-resources-for-managed-key 

Obtain a list of resources associated with a managed key in IBM Cloud. These cloud resources are protected by the key that you specify.

If the --all-pages option is not set, the command only retrieves a single page of the collection.

ibmcloud hpcs uko associated-resources-for-managed-key --id ID --uko-vault UKO-VAULT [--limit LIMIT] [--offset OFFSET] [--sort SORT]



* Command options

--id (string)
: Required. The UUID of the key. You can use the ibmcloud hpcs uko managed-keys command to retrieve the key UUID.

--uko-vault (string)
: Required. The UUID of the vault where the update is to take place. You can use the ibmcloud hpcs uko vaults command to retrieve the vault UUID.

--limit (int64)
: Optional. The number of resources to retrieve. The value must be between 1 and 1000.

--offset (int64)
: Optional. The number of resources to skip. The minimum value is 0.

--sort ([]string)
: Optional. The sorting order. The default value is ["name"].
* [Post-quantum cryptography support](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-pkcs11-introgrep11-support-post-quantum)



[Introducing EP11 over gRPC - Unified Key Orchestrator Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-grep11-introuko-grep11-intro)



* [Post-quantum cryptography support](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-grep11-introgrep11-support-post-quantum)







 About key rotation - Unified Key Orchestrator Plan 

[Master key rotation - Unified Key Orchestrator Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-master-key-rotation-introuko-master-key-rotation-intro)



* [How master key rotation works](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-master-key-rotation-introuko-how-master-key-rotation-works)
* [How keys are protected during master key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-master-key-rotation-introuko-how-master-key-protect-rotation)
* [How the IBM Cloud console reflects master key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-master-key-rotation-introuko-how-console-display-progress)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-master-key-rotation-introuko-master-key-rotation-next)