In some examples, a storage system includes a controller to receive a request for a data encryption key from the host system, in response to the request, retrieve, from a key manager system, the data encryption key for the host system, and encrypt the data encryption key retrieved from the key manager system using a first key, to produce an encrypted data encryption key. The controller sends the encrypted data encryption key to the host system, and receives, from the host system, encrypted data encrypted using the data encryption key.