What is the difference between NVE and NAE in ONTAP?

NetApp Volume Encryption (NVE) is a software-based, FIPS 140-2 compliant feature that allows for the encryption of data on a per-volume basis. NetApp Aggregate Encryption (NAE) encrypts all volumes within an aggregate. While both use the same encryption engine and key management, their scope of application is the key differentiator. NVE provides granular control, allowing administrators to encrypt specific volumes, whereas NAE applies encryption wholesale to an entire aggregate, including all its existing and future volumes. This makes NAE simpler for broad encryption mandates.

B. Both NAE and NVE can use either an onboard key manager or an external key manager (KMIP-compliant server), so this is not a differentiator.

C. Both NVE and NAE are software-based encryption features within ONTAP that leverage the AES-NI hardware acceleration instruction set in modern CPUs.

D. They are not identical; their fundamental difference lies in the granularity of encryption (volume-level vs. aggregate-level).

1. NetApp ONTAP Documentation. (2023). Overview of NetApp encryption solutions. NetApp Product Documentation. Retrieved from docs.netapp.com. In the section "NetApp encryption solutions," it states, "NetApp Volume Encryption (NVE) is a software-based, full-disk encryption solution... You can use NVE to encrypt a volume" and "NetApp Aggregate Encryption (NAE) is a software-based, full-disk encryption solution... NAE is applied to an entire aggregate."

2. NetApp ONTAP Documentation. (2023). How NetApp Aggregate Encryption works. NetApp Product Documentation. Retrieved from docs.netapp.com. This document explicitly contrasts the two: "Unlike NVE, which is enabled on a per-volume basis, NAE is enabled on a per-aggregate basis."