Netbackup encryption over deduplication

Some question for data encryption over client-side deduplication:

1. how the encryption key is created, and where is created?

2. where is the key kept (on the client, media server or master server) and how is the key being managed when encrypted backup gets duplicated to another media server

3. where does the decryption occur when restoring data, specially restoring to a different client host which is not the host that was backed up?

Thank you