Skip to main content

Assigning a data authentication key to a FIPS drive or SED (onboard key management)

You can use the storage encryption disk modify command to assign a data authentication key to a FIPS drive or SED. Cluster nodes use this key to access data on the drive.

Before you begin

You must be a cluster administrator to perform this task.

About this task

A self-encrypting drive is protected from unauthorized access only if its authentication key ID is set to a non-default value. The manufacturer secure ID (MSID), which has key ID 0x0, is the standard default value for SAS drives. For NVMe drives, the standard default value is a null key, represented as a blank key ID. When you assign the key ID of a self-encrypting drive, the system changes its authentication key ID to a non-default value.

  1. Assign a data authentication key to a FIPS drive or SED: storage encryption disk modify -disk disk_ID -data-key-id key_ID

    For complete command syntax, see the man page for the command.
    Note
    You can use the security key-manager query -key-type NSE-AK command to view key IDs.

    Example

    cluster1::> storage encryption disk modify -disk 0.10.* -data-key-id F1CB30AFF1CB30B00101000000000000A68B167F92DD54196297159B5968923C

    Info: Starting modify on 14 disks.
          View the status of the operation by using the
          storage encryption disk show-status command.
  2. Verify that the authentication keys have been assigned: storage encryption disk show

    For complete command syntax, see the man page.

    Example

    cluster1::> storage encryption disk show
    Disk    Mode Data Key ID
    -----   ---- ---------------------------------------------------------------- 
    0.0.0   data F1CB30AFF1CB30B00101000000000000A68B167F92DD54196297159B5968923C 
    0.0.1   data F1CB30AFF1CB30B00101000000000000A68B167F92DD54196297159B5968923C 
    [...]