Encryption at rest
Encrypt the log, the SSTs and the search segments on disk with AES-256.
With --enableEncryption, TeselaDB encrypts everything it stores on disk: the log blocks, the SST files, the manifests
and the search segments.
Shell
teseladb start --dbpath /var/lib/teseladb --enableEncryptionKeys
Without --encryptionKeyFile, the key comes from the master key of the cluster PKI (master.key). Data keys are
encrypted with the master key and rotated before encrypting 2³² blocks. With --encryptionKeyFile you use your own key
file, and with the options --kmipServerName, --kmipPort and --kmipKeyIdentifier, a KMIP server.
Algorithm
--encryptionCipherMode | Detail |
|---|---|
AES256-CBC (default) | Random IV per block and HMAC-SHA-256 |
AES256-GCM | Random nonce per block |
In MongoDB encryption at rest is part of the Enterprise edition; in TeselaDB it comes in the same binary.