Database encryption methods

To create an encrypted database – You can use the following:
- The Initialization utility (iqinit) in combination with various options to enable strong encryption.
  
  The iqinit utility -ep and -ek options create a database with strong encryption, allowing you to specify the encryption key in a prompt box or on the command line. The iqinit -ea option sets the encryption algorithm to AES or AES256 (or to AES_FIPS or AES256_FIPS for the FIPS-certified module).
- CREATE DATABASE statement.
To encrypt an existing database – Although you cannot simply turn strong encryption on or off in an existing database, you can use one of the following to implement strong encryption:
- Rebuild (unload/reload) an existing database and change the encryption status at that time. You can rebuild the database to unload all the data and schema of an existing database. This creates a new database (at which point you can change a variety of settings including strong encryption status), and reloads the data into the new database. You need to know the key to unload a strongly encrypted database. To rebuild (unload/reload) a database, use one of the following methods:
  - The Unload utility (dbunload)
    
    The Unload utility (dbunload) with options to create a new database with strong encryption. The -an option creates a new database. To specify strong encryption and the encryption key in a prompt box or on the command line use the -ep or -ek option. The -ea option sets the encryption algorithm to AES or AES256 (or to AES_FIPS or AES256_FIPS for the FIPS-certified module).
  - The UNLOAD and RELOAD statements
  - The Unload Database Wizard.
- You can use the CREATE ENCRYPTED DATABASE statement or the CREATE ENCRYPTED FILE statement.
To encrypt tables, columns, and materialized views – See Column and table encryption.