Disk encryption

Note: This feature is supported on 7250 IXR-6e and 7250 IXR-10e CPM4 with Root of Trust, 7250 IXR-X1b/X3b, and 7730 SXR systems.

Disk encryption protects sensitive information in configuration files, logs, and more generally, files located on disk partitions from unauthorized access at rest.

SR Linux uses dm-crypt kernel module block device encryption and LUKS to encrypt the system partitions using AES-XTS-plain64 with a 512-bit key size. The partitions encrypted are NOKIA-ETC, NOKIA-DATA, and NOKIA-OPT, located in the SSD or SD card of the control card.

The disk encryption key is stored in the Trusted Platform Module (TPM) of the control card and is unique per TPM. The key is read from the TPM to decrypt the disk partitions on boot. As each TPM uses a unique encryption key, the encrypted disk cannot be decrypted using a different control card.

Activating disk encryption

SR Linux supports activating disk encryption per control card. The activation requires a reboot of the control card. During the reboot, the partitions on the targeted control card are automatically encrypted without data loss.

To activate disk encryption, use the following command:
# tools platform trust disk-encryption control <A|B> activate

The following example activates disk encryption on slot A:

# tools platform trust disk-encryption control A activate

The following example shows the warning messages and prompt returned when activating disk encryption:


WARNING: Please proceed to manually reboot the control card for the request to take effect. Disk encryption is applied during the control card initialization after reboot. This request clears after 5 minutes in the absence of a reboot.
Note:
  • Disk encryption is not activated by default.
  • To deactivate disk encryption, perform a factory reset of the control card.

Checking disk encryption status

Disk encryption status is available per control card and per partition within the control card.

This example displays the disk encryption status for a control card.

A:Dut-A# info from state platform control A disk-encrypted
    platform {
        control A {
            disk-encrypted true
        }
    }