Skip to main content
This section covers creating keys on the KMES for encrypting the files. It also describes creating an encryption profile that defines the criteria the KMES uses to determine which files to encrypt on the SFTP or CIFS share and where to store the files. Perform these tasks after logging in locally to the Excrypt Touch with the print1 and print2 identities created in the previous section.

​
Create the necessary keys

Perform the following steps to create the necessary keys:
1
From the Excrypt Touch Dashboard, bring online the Connection Profile you created for connecting to the KMES Series 3.
2
After the device comes online, access the application manager for that device by selecting [ Go ] in the right column.
3
Log in to the KMES by using the print1 and print2 identities.
4
Go to the Keys menu and select [ Add Key Group ].
5
In the Key Group Editor window, configure the following settings:
SettingRequired configuration
Namefile_printing
AlgorithmNone
Owner groupSelect the printers role created in a previous section.
OwnershipSelect Do not apply to child key groups in the drop-down list.
Owner nameLeave blank
Owner addressLeave blank
6
Select [ OK ] to finish creating the key group.
7
Right-click the newly created key group and select Add > Random.
8
In the Generate Key window, configure the following settings:
SettingRequired configuration
Nameversion1
Key TypeFile Encryption Key
Encrypting KeyPMK
AlgorithmAES
Key LengthAES-256
Key UsageWrap/Unwrap
ExportabilityLeave unchecked
9
Select [ Next ] twice. Then on the summary page, select [ Finish ].
The new key now displays under the file_printing key group.
10
Right-click on the file_printing key group, and select Add> Random.
11
In the Generate Key window, configure the following settings:
SettingRequired configuration
Nameversion2
Key TypeFile Encryption Key v2
Encrypting KeyPMK
AlgorithmAES
Key LengthAES-256
Key UsageEncrypt/Decrypt
ExportabilityLeave unchecked
12
Select [ Next ] twice. Then on the summary page, select [ Finish ].
The new key now displays under the file_printing key group.

​
Create an encryption profile

Perform the following steps to create an encryption profile:
1
From the Excrypt Touch Dashboard, bring online the Connection Profile that you created for connecting to the KMES Series 3.
2
After the device comes online, access the application manager for that device by selecting [ Go ] in the right column.
3
Log in to the KMES using the print1 and print2 identities.
4
Go to the File Encryption menu and select [ Add ].
5
On the Info tab of the File Encryption Profile window, enter protected in the name field and change the key mode to HSM Protected. In the key field, select [ Choose ] and select the version2 key, which is in the file_printing key group.
6
Go to the Input tab and enter the following required information:
OptionDescription
SourceSelect the type of file share that the KMES mounts to for this file encryption profile (SFTP or CIFS). You can also set this field to Disabled if you want to set the mount point at a later time.
ExtensionSpecify the file extension which the KMES should monitor on the mount point and then encrypt.
DirectoryWhen you select [ Browse ], a file browser opens on either the SFTP or CIFS share (depending on which type of share you set in the Source field). In the file browser, navigate to and select the folder that contains the files that you want to be encrypted.
SubfoldersIf this box is checked, the KMES looks for files that are contained within subfolders of the folder configured in the Directory field.
Delete originalIf this box is checked, the KMES deletes the original unencrypted file after it stores the encrypted version of the file.
ExcludeSpecify file paths to exclude from file encryption (for example, exampledirectory/examplesubdirectory/*.txt). The exclude path that you specify is relative to the file encryption profile input directory. Also, note that the asterisk symbol is the only regular expression that you can use.
7
Go to the Output tab and enter the following required information:
OptionDescription
DestinationSelect the location where you want to store the encrypted files (such as SFTP, CIFS, or KMES). The KMES option stores the encrypted files on a data partition on the KMES device. You can set this field to Disabled if you want to set the location at a later time.
ExtensionIn this field, specify the extension that you want encrypted files to have.
DirectoryIf the destination is set to either SFTP or CIFS, select [ Browse ], which opens a file browser on whichever file share you configured. In the file browser, go to and select the directory where you want to store the encrypted files. If you selected KMES as the destination, you don’t need to configure this field.
OverwriteIn the drop-down menu, select either Overwrite or Version.
Include PathIf this box remains unchecked, the file header uses only the original file name. If this box is checked, the file header uses the entire path and original file name.
8
Select [ OK ] to finish creating the file encryption profile.