Encryption of stored data by AOS itself, using AES-256 without special drives, with keys held in Native KMS or an external KMS. Enabling it is permanent.
Read more: Nutanix docs
In the Ultra Transcenders books
Each book explains Software-only encryption in context, with comparison tables and the common traps.
Terms in this definition
- Encryption
Scrambling data so it cannot be read without the correct secret key, which is then used to turn it back again. Hashing, by contrast, cannot be reversed.
- AOS
Software that runs inside the Nutanix Controller VM on the hypervisor and delivers the platform's functions. Joining a cluster requires a node to pair it with a hypervisor in a supported combination.
- KEYS
Lists the column or columns that identify each target row uniquely in an AUTO CDC statement.
- Native KMS
The key manager built into Nutanix for software-only encryption. It runs locally on clusters of three or more nodes, or remotely through a registered Prism Central, usually for ROBO clusters of one or two nodes.
- External KMS
A separate key server for encrypting data at rest. It is mandatory with SEDs and dual encryption, and optional for software-only encryption as an alternative to Native KMS.
Related terms
- AES
A symmetric block cipher. Software-only encryption of stored data in AOS uses the 256-bit form, while SSH with keys can use the CTR modes at 128, 192 or 256 bits.