video blog - Page 384 - Developer IT

Campfire One: GWT 2.0 with Speed Tracer (pt. 3)

Campfire One: GWT 2.0 with Speed Tracer (pt. 3) Video footage of Google Campfire One on 12/8/09. From: GoogleDevelopers Views: 2914 14 ratings Time: 16:54 More in Science & Technology

New ZFS Encryption features in Solaris 11.1

Solaris 11.1 brings a few small but significant improvements to ZFS dataset encryption. There is a new readonly property 'keychangedate' that shows that date and time of the last wrapping key change (basically the last time 'zfs key -c' was run on the dataset), this is similar to the 'rekeydate' property that shows the last time we added a new data encryption key. $ zfs get creation,keychangedate,rekeydate rpool/export/home/bob NAME PROPERTY VALUE SOURCE rpool/export/home/bob creation Mon Mar 21 11:05 2011 - rpool/export/home/bob keychangedate Fri Oct 26 11:50 2012 local rpool/export/home/bob rekeydate Tue Oct 30 9:53 2012 local The above example shows that we have changed both the wrapping key and added new data encryption keys since the filesystem was initially created. If we haven't changed a wrapping key then it will be the same as the creation date. It should be obvious but for filesystems that were created prior to Solaris 11.1 we don't have this data so it will be displayed as '-' instead. Another change that I made was to relax the restriction that the size of the wrapping key needed to match the size of the data encryption key (ie the size given in the encryption property). In Solaris 11 Express and Solaris 11 if you set encryption=aes-256-ccm we required that the wrapping key be 256 bits in length. This restriction was unnecessary and made it impossible to select encryption property values with key lengths 128 and 192 when the wrapping key was stored in the Oracle Key Manager. This is because currently the Oracle Key Manager stores AES 256 bit keys only. Now with Solaris 11.1 this restriciton has been removed. There is still one case were the wrapping key size and data encryption key size will always match and that is where they keysource property sets the format to be 'passphrase', since this is a key generated internally to libzfs and to preseve compatibility on upgrade from older releases the code will always generate a wrapping key (using PKCS#5 PBKDF2 as before) that matches the key length size of the encryption property. The pam_zfs_key module has been updated so that it allows you to specify encryption=off. There were also some bugs fixed including not attempting to load keys for datasets that are delegated to zones and some other fixes to error paths to ensure that we could support Zones On Shared Storage where all the datasets in the ZFS pool were encrypted that I discussed in my previous blog entry. If there are features you would like to see for ZFS encryption please let me know (direct email or comments on this blog are fine, or if you have a support contract having your support rep log an enhancement request).

Search Results

Search found 19521 results on 781 pages for 'video blog'.

Page 384/781 | < Previous Page | 380 381 382 383 384 385 386 387 388 389 390 391 | Next Page >

- by darrenm

- by Alan

- by cjandaus

- by JuergenKress

- by guybarrette

- by caragh

- by kaleidoscope

- by Steven Chan (Oracle Development)

- by eterps

< Previous Page | 380 381 382 383 384 385 386 387 388 389 390 391 | Next Page >