Where do the D@RE encryption/decryption functions occur in the Unity storage system?

Upon installation and activation of the feature, the following keys are generated by

RSA BSAFE and persisted to the Lockbox:

A new KEK is generated each time the array boots. The KEK is wrapped with the KWK and passed to the SAS controller during the system boot process. Using the persisted KWK, the SAS controller can decrypt the KEK.