New ZFS Encryption features in Solaris 11.1
- by darrenm
Solaris 11.1 brings a few small but significant improvements to ZFS dataset encryption. There is a new readonly property 'keychangedate' that shows that date and time of the last wrapping key change (basically the last time 'zfs key -c' was run on the dataset), this is similar to the 'rekeydate' property that shows the last time we added a new data encryption key.
$ zfs get creation,keychangedate,rekeydate rpool/export/home/bob
NAME PROPERTY VALUE SOURCE
rpool/export/home/bob creation Mon Mar 21 11:05 2011 -
rpool/export/home/bob keychangedate Fri Oct 26 11:50 2012 local
rpool/export/home/bob rekeydate Tue Oct 30 9:53 2012 local
The above example shows that we have changed both the wrapping key and added new data encryption keys since the filesystem was initially created. If we haven't changed a wrapping key then it will be the same as the creation date. It should be obvious but for filesystems that were created prior to Solaris 11.1 we don't have this data so it will be displayed as '-' instead.
Another change that I made was to relax the restriction that the size of the wrapping key needed to match the size of the data encryption key (ie the size given in the encryption property). In Solaris 11 Express and Solaris 11 if you set encryption=aes-256-ccm we required that the wrapping key be 256 bits in length. This restriction was unnecessary and made it impossible to select encryption property values with key lengths 128 and 192 when the wrapping key was stored in the Oracle Key Manager. This is because currently the Oracle Key Manager stores AES 256 bit keys only. Now with Solaris 11.1 this restriciton has been removed.
There is still one case were the wrapping key size and data encryption key size will always match and that is where they keysource property sets the format to be 'passphrase', since this is a key generated internally to libzfs and to preseve compatibility on upgrade from older releases the code will always generate a wrapping key (using PKCS#5 PBKDF2 as before) that matches the key length size of the encryption property.
The pam_zfs_key module has been updated so that it allows you to specify encryption=off.
There were also some bugs fixed including not attempting to load keys for datasets that are delegated to zones and some other fixes to error paths to ensure that we could support Zones On Shared Storage where all the datasets in the ZFS pool were encrypted that I discussed in my previous blog entry.
If there are features you would like to see for ZFS encryption please let me know (direct email or comments on this blog are fine, or if you have a support contract having your support rep log an enhancement request).
