1. Managing ZFS File Systems in Oracle Solaris 11.4
  2. Managing Oracle Solaris ZFS File Systems
  3. Encrypting ZFS File Systems
  4. Changing an Encrypted ZFS File System's Keys

Changing an Encrypted ZFS File System's Keys

You can change an encrypted file system's wrapping key by using the zfs key -c command. The existing wrapping key must have been loaded first, either at boot time or by explicitly loading the file system key (zfs key -l) or by mounting the file system (zfs mount filesystem). For example: 

$ zfs key -c tank/home/megr
Enter new passphrase for 'tank/home/megr': xxxxxxxx
Enter again: xxxxxxxx

In the following example, the wrapping key is changed and the keysource property value is changed to specify that the wrapping key comes from a file. 

$ zfs key -c -o keysource=raw,file:///media/stick/key
tank/home/megr

The data encryption key for an encrypted file system can be changed by using the zfs key -K command, but the new encryption key is only used for newly written data. This feature can be used to provide compliance with NIST 800-57 guidelines on a data encryption key's time limit. For example: 

$ zfs key -K tank/home/megr

In the above example, the data encryption key is not visible nor is it directly managed by you. In addition, you need the keychange delegation to perform a key change operation.

The following encryption algorithms are available:

  • aes-128-ccm, aes-192-ccm, aes-256-ccm

  • aes-128-gcm, aes-192-gcm, aes-256-gcm

The ZFS keysource property identifies the format and location of the key that wraps the file system's data encryption keys. For example: 

$ zfs get keysource tank/home/megr
NAME              PROPERTY   VALUE              SOURCE
tank/home/megr  keysource  passphrase,prompt  local

The ZFS rekeydate property identifies the date of the last zfs key -K operation. For example: 

$ zfs get rekeydate tank/home/megr
NAME              PROPERTY   VALUE                  SOURCE
tank/home/megr  rekeydate  Wed Jul 25 16:54 2012  local

If an encrypted file system's creation and rekeydate properties have the same value, the file system has never been rekeyed by an zfs key -K operation.