Changing a Database Encryption Key

To change the manner a database encryption key is protected, as well as who its owner is, use the alter encryption key command.

You cannot regenerate a database encryption key for a database.

To change a database encryption key:
1. Decrypt the database protected by the database encryption key.
2. Drop, and re-create the database encryption key.
Note: You cannot convert a column encryption key into a database encryption key. SAP ASE displays an error message if you alter a different type of encryption key into a database encryption key using the for database encryption option.
To simply change the way a database encryption key is protected, rather than change the database encryption key altogether, use this syntax:
```
alter encryption key key_name
for database encryption
modify encryption with {[master key] 
    [[no] dual_control}
```
To change the owner of a database encryption key:
```
alter encryption key [[database.][owner].]dek_name
    modify owner user_name
```
The permission to run this option is the same as the permission for alter encryption key.