aboutsummaryrefslogtreecommitdiffstats
path: root/man/man8/zfs.8
diff options
context:
space:
mode:
Diffstat (limited to 'man/man8/zfs.8')
-rw-r--r--man/man8/zfs.827
1 files changed, 14 insertions, 13 deletions
diff --git a/man/man8/zfs.8 b/man/man8/zfs.8
index a8e859bdc..3b118ac3e 100644
--- a/man/man8/zfs.8
+++ b/man/man8/zfs.8
@@ -2380,17 +2380,19 @@ configuration is not supported.
.Ss Encryption
Enabling the
.Sy encryption
-feature allows for the creation of encrypted filesystems and volumes.
-.Nm
-will encrypt all user data including file and zvol data, file attributes,
-ACLs, permission bits, directory listings, FUID mappings, and userused /
-groupused data.
-.Nm
-will not encrypt metadata related to the pool structure, including dataset
-names, dataset hierarchy, file size, file holes, and dedup tables. Key rotation
-is managed internally by the kernel module and changing the user's key does not
-require re-encrypting the entire dataset. Datasets can be scrubbed, resilvered,
-renamed, and deleted without the encryption keys being loaded (see the
+feature allows for the creation of encrypted filesystems and volumes. ZFS
+will encrypt file and zvol data, file attributes, ACLs, permission bits,
+directory listings, FUID mappings, and
+.Sy userused
+/
+.Sy groupused
+data. ZFS will not encrypt metadata related to the pool structure, including
+dataset and snapshot names, dataset hierarchy, properties, file size, file
+holes, and deduplication tables.
+.Pp
+Key rotation is managed by ZFS. Changing the user's key (e.g. a passphrase)
+does not require re-encrypting the entire dataset. Datasets can be scrubbed,
+resilvered, renamed, and deleted without the encryption keys being loaded (see the
.Nm zfs Cm load-key
subcommand for more info on key loading).
.Pp
@@ -2432,8 +2434,7 @@ read-only
.Sy encryptionroot
property.
.Pp
-Encryption changes the behavior of a few
-.Nm
+Encryption changes the behavior of a few ZFS
operations. Encryption is applied after compression so compression ratios are
preserved. Normally checksums in ZFS are 256 bits long, but for encrypted data
the checksum is 128 bits of the user-chosen checksum and 128 bits of MAC from