Passphrase removal for encrypted pool no longer available on Freenas 11.2-U4

[Apollo]

As the title says it, under the new GUI, the option to remove the passphrase to an encrypted volume is no longer available.
Either the feature was lost again or it is well hidden.

I remember I had this issue a few updates ago and I believe it has been reintroduced then.
For now, I was able to remove the passphrase using the legacy GUI.

 

[Ericloewe]

What is the feature supposed to do? Delete the first key? Replace the first key with one that doesn't take a passphrase?

 

[Apollo]

If you set a passphrase to an encrypted pool, you will need to enter the passphrase anytime you reboot in order to unlock the pool.
If you do not set a passphrase, upon reboot, the pool will be automatically unlocked.

By default, you can create a passphrase and later on change it to a different passphrase. The new GUI doesn't give you the ability to remove the passphrase. The old GUI does however.

 

[Ericloewe]

My question is specifically whether the key that gets thrown out gets replaced with a new one (which presumably gets stored in the boot device).

 

[Apollo]

I don't think the key gets thrown out.
If I remove the passphrase and later on decide to use the same passphrase, upon exporting and importing the pool back, I believe the GELI keys are still valid.

 

[Ericloewe]

I don't think the key gets thrown out.

It has to. Well, conceivably you could re-use the key sans the passphrase, but it's fundamentally a different secret then. I'm not sure if the cryptography holds up if you try that, because the plaintext - the master key which actually encrypts the disk - doesn't change, so you might be leaking information. But that's just me erring on the side of caution by virtue of not being a cryptographer.

 

[Apollo]

Back to the original question, why has the passphrase removal check box been removed in the new GUI?

 

[Ericloewe]

It sounds like an oversight of some sort. File a bug report and post the issue number here.

 

[Apollo]

Filed:
https://jira.ixsystems.com/browse/NAS-101759