# Data Object - VsanHostEncryptionInfo(vim.vsan.host.EncryptionInfo)

Property of
  VsanEncryptionHealthSummary, VsanHostConfigInfoEx, VsanPrepareVsanForVcsaSpec, VsanVcPostDeployConfigSpec
Extends
  DynamicData
See also
  KmipServerSpec
Since
  vSAN API 6.6

## Data Object Description

VMware vSAN can encrypt data on the disk. Below terminologies and their acronyms are used to demonstrate how the encryption works. DEK - Data Encryption Key. Keys that are used to encryption data on each disk. Plain DEK will not be persisted by vSAN for safety. Instead, vSAN will encrypt the DEK and store the encrypted format. KEK - Key Encryption Key. A vSAN cluster will maintain a KEK that is used to encrypt the DEKs. vSAN does not persist the KEK. It only persists the Id of the KEK, and retrieve plain KEK from KMS (mentioned below) by providing the KEK's Id. KMS - Key Management Server, where KEK is generated and stored, we support KMS from several popular vendors, such as SafeNet, Thales, Vormetrics, and HyTrust. Encryption configuration for vSAN encryption service. It contains encryption enablement state, KEK Id, KMS information, client certificate, private key, and KMS certificates.

Properties

Name | Type | Description
--- | --- | ---
changing* | xsd:boolean | Whether encryption state is currently changing to have all disk groups matching the state described in enabled.
clientCert* | xsd:string | Client certificate in PEM encoding. Host will use this certificate for authentication when connecting to KMS.
clientKey* | xsd:string | Client private key. Host will use this key for authentication when connecting to KMS.
dekGenerationId* | xsd:long | Data Encryption Key (DEK) generation number.
dekId* | xsd:string | UUID of cluster wide Data Encryption Key (DEK). Since vSAN API 8.0.0.1
dekVerifier* | xsd:string | Verifier of DEK. It's calculated by encrypting all zero data with DEK. ESX host can verify DEK correctness using this verifier. Since vSAN API 8.0.0.1
enabled* | xsd:boolean | Encryption enablement state.
eraseDisksBeforeUse* | xsd:boolean | Whether disks should be wiped when a normal disk is converted to encrypted disk, or a disk is claimed as encrypted disk, or a disk runs deep rekey. If set true, every sector on a disk will be written with random data. Disk wipe does significantly reduce the possibility of data leak and increases the attacker's cost to reveal sensitive data. The disadvantage of disk wipe is that it takes a long time to finish, so turn it on through UI or API only when necessary. If not set, disk won't be wiped.
hostKeyId* | xsd:string | The Id of host key which is used for host core dump encryption. This should be generated by vCenter to call key management server and pass to ESXi host. ESXi host can later retrieve the key with this ID.
iv* | xsd:string | Initialization vector used by encryption algorithm. The vector is encoded as a string. Since vSAN API 8.0.0.1
kekId* | xsd:string | Unique ID for the KEK in the KMS cluster. It's returned by KMS after vCenter invoking key generation operation. ESX host can retrieve the key with this ID.
kekVerifier* | xsd:string | Verifier of KEK. It's calculated by encrypting all zero data with KEK. ESX host can verify KEK correctness using this verifier. Since vSAN API 8.0.0.1
kmipServers* | KmipServerSpec[] | The KMS servers where the global KEK is created and stored. Host will fetch KEK from the KMS cluster with given KEK ID.
kmsServerCerts* | xsd:string[] | Certificates of Key Management Servers in PEM encoding. Host will use these certificates to decide if a KMS should be trusted or not.
oldDekId* | xsd:string | UUID of the old cluster wide Data Encryption Key (DEK). Since vSAN API 8.0.0.1
oldDekVerifier* | xsd:string | Verifier of old DEK. It's calculated by encrypting all zero data with old DEK. ESX host can verify old DEK correctness using this verifier. Since vSAN API 8.0.0.1
oldWrappedDek* | xsd:string | Old Data Encryption Key (DEK) wrapped by Key Encryption Key (KEK). Since vSAN API 8.0.0.1
syncing* | xsd:boolean | Whether the cluster is syncing encryption config when it enables encryption or does deep rekey. Since vSAN API 8.0.0.1
wrappedDek* | xsd:string | Data Encryption Key (DEK) wrapped by Key Encryption Key (KEK). Since vSAN API 8.0.0.1
Properties inherited from DynamicData
None

*Need not be set
Show WSDL type definition
<complexType xmlns="http://www.w3.org/2001/XMLSchema" xmlns:vsan="urn:vsan" name="VsanHostEncryptionInfo"> <complexContent> <extension base="vsan:DynamicData"> <sequence> <element name="enabled" type="xsd:boolean" minOccurs="0"/> <element name="kekId" type="xsd:string" minOccurs="0"/> <element name="hostKeyId" type="xsd:string" minOccurs="0"/> <element name="kmipServers" type="vsan:KmipServerSpec" minOccurs="0" maxOccurs="unbounded"/> <element name="kmsServerCerts" type="xsd:string" minOccurs="0" maxOccurs="unbounded"/> <element name="clientKey" type="xsd:string" minOccurs="0"/> <element name="clientCert" type="xsd:string" minOccurs="0"/> <element name="dekGenerationId" type="xsd:long" minOccurs="0"/> <element name="changing" type="xsd:boolean" minOccurs="0"/> <element name="eraseDisksBeforeUse" type="xsd:boolean" minOccurs="0"/> <element name="wrappedDek" type="xsd:string" minOccurs="0"/> <element name="dekId" type="xsd:string" minOccurs="0"/> <element name="oldWrappedDek" type="xsd:string" minOccurs="0"/> <element name="oldDekId" type="xsd:string" minOccurs="0"/> <element name="kekVerifier" type="xsd:string" minOccurs="0"/> <element name="dekVerifier" type="xsd:string" minOccurs="0"/> <element name="oldDekVerifier" type="xsd:string" minOccurs="0"/> <element name="iv" type="xsd:string" minOccurs="0"/> <element name="syncing" type="xsd:boolean" minOccurs="0"/> </sequence> </extension> </complexContent> </complexType>