20:24:43 <szilard> I have got this encrypted dataset:
20:24:46 <szilard> ```
20:24:48 <szilard> NAME                PROPERTY    VALUE        SOURCE
20:24:51 <szilard> tank/storage/test  encryption  aes-256-ccm  -
20:24:54 <szilard> ```
20:24:56 <szilard> as you can see, the key source is "-". The system mounts the dataset just fine automatically after a reboot. I am wondering where is the key is stored?
21:07:25 <danmcd> Look for "keylocation" "keyformat" and "pbkdf2iters" properties in this dataset?
21:07:47 <danmcd> `zfs get keylocation,keyformat,pbkdf2iters tank/storage/test ` ?
21:08:31 <danmcd> And that's not the "key source" that's the "Source of who set this property".
21:08:53 <danmcd> E.g.
21:09:37 <danmcd> [root@moe (kebecloud) ~]# zfs get volblocksize zones/swap
21:09:37 <danmcd> NAME        PROPERTY      VALUE     SOURCE
21:09:37 <danmcd> zones/swap  volblocksize  4K        -
21:09:39 <danmcd> [root@moe (kebecloud) ~]# 
21:09:44 <danmcd> That swap zvol was created with 4k.
21:10:03 <danmcd> zones/swap  sync                  always                 local 
21:10:08 <danmcd> Changed locally.
21:11:43 <danmcd> My unencrypted boot pool's top-level ZFS filesystem has encryption properties even if it's a cleartext one:
21:11:46 <danmcd> bootpool  encryption            off                    default
21:11:47 <danmcd> bootpool  keylocation           none                   default
21:11:47 <danmcd> bootpool  keyformat             none                   default
21:11:48 <danmcd> bootpool  pbkdf2iters           0                      default
21:12:23 <danmcd> I'll bet yours, szilard , are far more instructive.
21:20:02 <tsoome> SOURCE column is not for key source, it is where from the property value is coming.
21:31:13 <danmcd> ^^^ better stated than what I said (And that's not the "key source"....)
21:36:22 <szilard> Thanks for the hints!
21:36:27 <szilard> It says:
21:36:30 <szilard> NAME                PROPERTY     VALUE        SOURCE
21:36:31 <szilard> tank/storage/test  keylocation  prompt       local
21:36:31 <szilard> tank/storage/test  keyformat    passphrase   -
21:36:31 <szilard> tank/storage/test  pbkdf2iters  350000       -
21:38:08 <tsoome> so, if you enter. zfs load-key tank/storage/test, it will prompt for key
21:43:15 <szilard> And what happens if i misremember the key
21:44:06 <tsoome> it will ask again:)
21:44:24 <szilard> I dont want to risk locking the currently unlocked dataset.
21:45:26 <tsoome> it does not have built in locking system. 
21:45:52 <szilard> I wrote down the key, but i havent tested if it works and already stored some important info on the dataset. I am not prepared for the worst outcome.
21:46:30 <tsoome> pbkdf2iters will ensure you will not to get next try too quick, but thats about it.
21:47:41 <szilard> Ok, i dont have the key here with me, so the test needs to wait till i get it. But thanks, i'll definetely test it.
21:48:58 <szilard> Do i assume it correctly it will ask for the key and if the correct key entered it will somehow communicate the key is OK?
21:51:10 <tsoome> it will test if key is decrypting key, if so, the key is loaded into internal keystore and command will exit with status 0 (echo $?)
21:51:23 <szilard> There arent too many up-to-date blogs about Solaris, but i found this, it can be interesting for you guys: https://www.c0t0d0s0.org/
21:51:39 <szilard> tsoome: thanks!
21:52:02 <tsoome> after that you can access the data as the data access functions will pick the key from keystore automatically
21:52:50 <szilard> But i still dont know how the encrypted dataset gets mounted at boot. It didnt asks for a key, so it must be stored somewhere, or some trick is used.
21:52:53 <tsoome> the passphrase is converted to the actual key by pbkdf2 key derivation function.
21:53:27 <tsoome> mount does not  really imply having the key
21:53:50 <tsoome> but accessing the data does
21:54:09 <szilard> I can access the content of the dataset without needing to supply any key after the reboot.
21:55:08 <tsoome> um, are you sure the dataset is actually mounted?
21:55:55 <tsoome> maybe you did copy data to mountpoint and the dataset is in fact not mounted?
21:56:35 <szilard> I am using the dataset attached to a sparse zone. Let me check...
21:56:44 <tsoome> you can check with df/mount/grep datasetname /etc/mnttab
22:02:15 <szilard> Yep, it isnt mounted. I wrote into the mountpoint. Yeez.!
22:02:49 <szilard> I need to fix this asap. Thanks for your help!
22:03:07 <tsoome> yw