Skip to main content

Assign a data authentication key to a FIPS drive or SED (onboard key management) with ONTAP

Contributors netapp-ahibbard netapp-thomi netapp-dbagwell netapp-aaron-holt netapp-aherbin
PDFs

You can use the storage encryption disk modify command to assign a data authentication key to a FIPS drive or SED. Cluster nodes use this key to access data on the drive.

About this task

A self-encrypting drive is protected from unauthorized access only if its authentication key ID is set to a non-default value. The manufacturer secure ID (MSID), which has key ID 0x0, is the standard default value for SAS drives. For NVMe drives, the standard default value is a null key, represented as a blank key ID. When you assign the key ID to a self-encrypting drive, the system changes its authentication key ID to a non-default value.

Before you begin

You must be a cluster administrator to perform this task.

Steps

  1. Assign a data authentication key to a FIPS drive or SED:

    storage encryption disk modify -disk disk_ID -data-key-id key_ID

    Learn more about storage encryption disk modify in the ONTAP command reference.

    Note

    You can use the security key-manager key query -key-type NSE-AK command to view key IDs.

    		 
    cluster1::> storage encryption disk modify -disk 0.10.* -data-key-id <id_value>

Info: Starting modify on 14 disks.
      View the status of the operation by using the
      storage encryption disk show-status command.

  2. Verify that the authentication keys have been assigned:

    storage encryption disk show

    Learn more about storage encryption disk show in the ONTAP command reference.

    cluster1::> storage encryption disk show
Disk    Mode Data Key ID
-----   ---- ----------------------------------------------------------------
0.0.0   data <id_value>
0.0.1   data <id_value>
[...]