topic Re: SVM-KEK (Key Encryption Key) in ONTAP Discussions

SVM-KEK (Key Encryption Key)

MK2 — Wed, 22 Jan 2025 09:05:18 GMT

Hello,

sadly, I fail to get any information of the purpose of a SVM-KEK.
Is there any (official) information when and why a SVM-KEK is useful? What excatly does the SVM-KEK do?

Tried to google it, but could only find depreacted information on this topic:
https://docs.netapp.com/us-en/ontap-cli-96/security-key-manager-key-show.html

Thank you in advance.

Re: SVM-KEK (Key Encryption Key)

Kamran_Alam — Wed, 22 Jan 2025 09:25:04 GMT

Hi,

There are 3 types of encryption offered as below:

NetApp Storage Encryption (NSE) is a hardware solution that uses self-encrypting drives.
NetApp Volume Encryption (NVE) is a software solution that enables encryption of any data volume on any drive type where it is enabled with a unique key for each volume.
NetApp Aggregate Encryption (NAE) is a software solution that enables encryption of any data volume on any drive type where it is enabled with unique keys for each aggregate.

What is your requirement ?

Re: SVM-KEK (Key Encryption Key)

MK2 — Wed, 22 Jan 2025 09:40:17 GMT

Hello,
I know about the other 3. Plus, NetApp offers information on these types.
My question is solely on the SVM-KEK, its requirement and its purpose. Is there any handbook on that topic? Or is it deprecated?

Thank you in advance.

Re: SVM-KEK (Key Encryption Key)

Kamran_Alam — Wed, 22 Jan 2025 10:07:20 GMT

This command is deprecated and might be removed in a future release.

Use security key-manager key query instead.

security key-manager key show

security key-manager key show -detail

Example:

Node: node1
Key Store: onboard
Used By
--------
NSE-AK
    Key ID: 000000000000000002000000000001001bc4c708e2a89a312e14b6ce6d4d49d40000000000000000
NSE-AK
    Key ID: 000000000000000002000000000001005e89099721f8817e65e3aeb68be1bfca0000000000000000
SVM-KEK
    Key ID: 00000000000000000200000000000a0046df92864d4cece662b93beb7f5366100000000000000000

Node: node2
Key Store: onboard
Used By
--------
NSE-AK
    Key ID: 000000000000000002000000000001001bc4c708e2a89a312e14b6ce6d4d49d40000000000000000
NSE-AK
    Key ID: 000000000000000002000000000001005e89099721f8817e65e3aeb68be1bfca0000000000000000
SVM-KEK
    Key ID: 00000000000000000200000000000a0046df92864d4cece662b93beb7f5366100000000000000000
6 entries were displayed.

https://docs.netapp.com/us-en/ontap-cli-96/security-key-manager-key-show.html#description

Re: SVM-KEK (Key Encryption Key)

Kamran_Alam — Wed, 22 Jan 2025 10:11:54 GMT

Please read the following report, it will provide you clear understanding.

https://www.niap-ccevs.org/MMO/Product/st_vid11175-st.pdf

Re: SVM-KEK (Key Encryption Key)

MK2 — Thu, 23 Jan 2025 11:34:17 GMT

Thank you! That was the information I was looking for.

PS: Due to the lack of information I believe, that the usage of SVM-KEK is not recommended anymore (deprecated)

Re: SVM-KEK (Key Encryption Key)

Kamran_Alam — Wed, 05 Mar 2025 06:31:12 GMT

Thank you for your acknowledgment.

Could you please mark this as a solution

Thank you