Is there a way to disable Optane DC PM side encryption?

39 views
Skip to first unread message

Kan Wu

unread,
Jul 29, 2019, 1:17:57 PM7/29/19
to pmem
Hi there,

I have learned that Optane DC PM side has encryption for security reason. 
Im wondering is there a way to disable it? since we want to test the performance difference between encryption enabled and disabled.

Thanks,
Kan

Steve Scargall

unread,
Jul 29, 2019, 2:00:58 PM7/29/19
to pmem
No.  Encryption at rest is always ON with no way to disable it.  You can enable/disable passphrases that further secure the data.

Anton Gavriliuk

unread,
Jul 29, 2019, 2:16:22 PM7/29/19
to Steve Scargall, pmem
> I have learned that Optane DC PM side has encryption for security reason. 
Im wondering is there a way to disable it? since we want to test the performance difference between encryption enabled and disabled.

As far as I know pmem is encrypted by AES256.  Disabling encryption will not improve perofrmance noticebly.  I think encypted performance is pretty good :-)

Anton

пн, 29 июл. 2019 г. в 21:01, Steve Scargall <steve.s...@intel.com>:
No.  Encryption at rest is always ON with no way to disable it.  You can enable/disable passphrases that further secure the data.

--
You received this message because you are subscribed to the Google Groups "pmem" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pmem+uns...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/pmem/cc20760d-7944-46ad-98e7-d4485e558081%40googlegroups.com.

Kan Wu

unread,
Jul 30, 2019, 1:52:53 PM7/30/19
to pmem
Get you, thanks.


On Monday, July 29, 2019 at 11:16:22 AM UTC-7, Anton Gavriliuk wrote:
> I have learned that Optane DC PM side has encryption for security reason. 
Im wondering is there a way to disable it? since we want to test the performance difference between encryption enabled and disabled.

As far as I know pmem is encrypted by AES256.  Disabling encryption will not improve perofrmance noticebly.  I think encypted performance is pretty good :-)

Anton

пн, 29 июл. 2019 г. в 21:01, Steve Scargall <steve....@intel.com>:
No.  Encryption at rest is always ON with no way to disable it.  You can enable/disable passphrases that further secure the data.

--
You received this message because you are subscribed to the Google Groups "pmem" group.
To unsubscribe from this group and stop receiving emails from it, send an email to pm...@googlegroups.com.

Kan Wu

unread,
Jul 30, 2019, 1:56:53 PM7/30/19
to pmem
That make sense, thanks!
A further question:

Is there any documents on how would RDMA interacts with the encryption in optane DC PM?
For example: 
1) if node A need RDMA access to optane DC PM on node B, does node A need to provide a passphrase(if enabled)?
2) in app-direct mode, can node A RDMA access the PM on node B?


Thanks.

Steve Scargall

unread,
Jul 30, 2019, 2:28:14 PM7/30/19
to pmem


On Tuesday, July 30, 2019 at 11:56:53 AM UTC-6, Kan Wu wrote:
That make sense, thanks!
A further question:

Is there any documents on how would RDMA interacts with the encryption in optane DC PM?
For example: 
1) if node A need RDMA access to optane DC PM on node B, does node A need to provide a passphrase(if enabled)?
2) in app-direct mode, can node A RDMA access the PM on node B?

A1) In this first generation of Optane DC PM, there is just one key which we use to unlock the DIMMs [at boot time].  Therefore, once the data is unlocked, RDMA can occur without needing to worry about transferring keys.  You can use librpmem from the PMDK, Mellanox On-Demand Paging, or libfabrics.  There is a current project to support RDMA with FSDAX in Linux. 

References:



A2) Yes. Typically the 'writer/master' node initiates the RDMA copy to the remote host.  This is how librpmem works.  For reading, either direction should work assuming the data isn't changing.

Since RDMA was never designed for persistence, the current implementation requires multiple round trips.  This will change with the "Remote Persistent Memory" discussion ongoing in the industry, via SNIA. The solution requires both HW and SW changes.   

Reading Material:


Reply all
Reply to author
Forward
0 new messages