Modifying encryption in a storage system

1. A method, comprising:

receiving an instruction to rekey data on one or more storage devices, wherein the instruction identifies first encryption information and second encryption information;

determining that the instruction is authorized;

decrypting, by a processing device of a storage system controller coupled to the one or more storage devices, the data on the one or more storage devices using a current key included in the first encryption information to generate decrypted data; and

encrypting, by the processing device of the storage system controller coupled to the one or more storage devices, the decrypted data on the one or more storage devices using the second encryption information to generate encrypted data.

2. The method of claim 1 , wherein the first encryption information comprises:

an identifier of: a current key, a current encryption algorithm, and a current initialization vector scheme; and

wherein the second encryption information comprises:

an identifier of: a desired key, a desired encryption algorithm, and a desired initialization vector scheme.

3. The method of claim 2 , wherein the first encryption information further comprises: a proof of possession of the current key; and

wherein the second encryption information further comprises: a proof of possession of the desired key.

4. The method of claim 2 , wherein the current key is the same as the desired key.

5. The method of claim 1 , wherein the instruction further identifies a range of logical block addresses corresponding to the data.

6. The method of claim 1 , wherein the rekey instruction is part of a Small Computer System Interface (SCSI), Non-Volatile Memory Express (NVMe), Presentational State Transfer (REST), or vStorage Application Programming Interface for Storage Awareness (VASA) instruction set.

7. The method of claim 1 , further comprising: writing metadata for an application associated with the data that instructs the processing device of the storage system controller to use the second encryption information for future write operations of the application.

8. The method of claim 1 , wherein the rekey instruction comprises an instruction to copy the data to a target location identified by the rekey instruction, further comprising: copying the encrypted data to the target location.

9. A system comprising:

one or more storage devices; and

a controller coupled to the one or more storage devices and configured to:

receive an instruction to rekey data on the one or more storage devices, wherein the instruction identifies first encryption information and second encryption information;

determine that the instruction is authorized;

decrypt the data on the one or more storage devices using a current key included in the first encryption information to generate decrypted data; and

encrypt the decrypted data on the one or more storage devices using the second encryption information to generate encrypted data.

10. The storage system of claim 9 , wherein the first encryption information comprises:

an identifier of: a current key, a current encryption algorithm, and a current initialization vector scheme; and

wherein the second encryption information comprises:

an identifier of: a desired key, a desired encryption algorithm, and a desired initialization vector scheme.

11. The storage system of claim 10 , wherein the first encryption information further comprises: a proof of possession of the current key; and

wherein the second encryption information further comprises: a proof of possession of the desired key.

12. The storage system of claim 10 , wherein the current key is the same as the desired key.

13. The storage system of claim 9 , wherein the instruction further identifies a range of logical block addresses corresponding to the data.

14. The storage system of claim 9 , wherein the rekey instruction is part of a Small Computer System Interface (SCSI), Non-Volatile Memory Express (NVMe), Presentational State Transfer (REST), or vStorage Application Programming Interface for Storage Awareness (VASA) instruction set.

15. The storage system of claim 9 , the controller further configured to: write metadata for an application associated with the data that instructs the controller to use the second encryption information for future write operations of the application.

16. The storage system of claim 9 , wherein the rekey instruction comprises an instruction to copy the data to a target location identified by the rekey instruction, and wherein the controller is further configured to: copy the encrypted data to the target location.

17. A system comprising:

one or more storage devices; and

a controller coupled to the one or more storage devices and configured to:

receive an instruction to rekey data on the one or more storage devices to correspond to desired encryption information;

determine that the data on the one or more storage devices was decrypted using correct encryption information; and

based on the determining, modify metadata associated with the data on the one or more storage devices to correspond to the desired encryption information.

18. The storage system of claim 17 , the controller further configured to:

receive an instruction to read the data on the one or more storage devices;

encrypt the data on the one or more storage devices using the desired encryption information to generate encrypted data; and

provide the encrypted data.

19. The storage system of claim 17 , wherein the desired encryption information comprises:

an identifier of: a desired key, a desired encryption algorithm, and a desired initialization vector scheme.

20. The storage system of claim 17 wherein the rekey instruction is part of a Small Computer System Interface (SCSI), Non-Volatile Memory Express (NVMe), Presentational State Transfer (REST), or vStorage Application Programming Interface for Storage Awareness (VASA) instruction set.