Skip to main content

Assign a data authentication key to a FIPS drive or SED (external key management)

Contributors netapp-thomi netapp-ahibbard netapp-aherbin
PDFs

You can use the storage encryption disk modify command to assign a data authentication key to a FIPS drive or SED. Cluster nodes use this key to lock or unlock encrypted data on the drive.

About this task

A self-encrypting drive is protected from unauthorized access only if its authentication key ID is set to a non-default value. The manufacturer secure ID (MSID), which has key ID 0x0, is the standard default value for SAS drives. For NVMe drives, the standard default value is a null key, represented as a blank key ID. When you assign the key ID to a self-encrypting drive, the system changes its authentication key ID to a non-default value.

This procedure is not disruptive.

Before you begin

You must be a cluster administrator to perform this task.

Steps

  1. Assign a data authentication key to a FIPS drive or SED:

    storage encryption disk modify -disk disk_ID -data-key-id key_ID

    For complete command syntax, see the man page for the command.

    Note

    You can use the security key-manager query -key-type NSE-AK command to view key IDs.

    		 
    cluster1::> storage encryption disk modify -disk 0.10.* -data-key-id F1CB30AFF1CB30B00101000000000000A68B167F92DD54196297159B5968923C

Info: Starting modify on 14 disks.
      View the status of the operation by using the
      storage encryption disk show-status command.

  2. Verify that the authentication keys have been assigned:

    storage encryption disk show

    For complete command syntax, see the man page.

    cluster1::> storage encryption disk show
Disk    Mode Data Key ID
-----   ---- ----------------------------------------------------------------
0.0.0   data F1CB30AFF1CB30B00101000000000000A68B167F92DD54196297159B5968923C
0.0.1   data F1CB30AFF1CB30B00101000000000000A68B167F92DD54196297159B5968923C
[...]