Column Encryption

Certain datatypes can be encrypted.

• Encrypting Columns on New Tables
  To encrypt columns in a new table, use the encrypt column qualifier on the create table statement.
• Encrypting Columns in Existing Tables
  To encrypt columns in existing tables, use the modify column option on the alter table statement with the encrypt clause.
• Index Creation and Constraints on Encrypted Columns
  You can create an index on an encrypted column if the encryption key has been specified without any initialization vector or random padding.
• Domain Creation and Access Rules on Encrypted Columns
  You can create domain rules, check constraints, or access rules on encrypted columns. However, decrypt permission is required on an encrypted column when it is used in target list, where clause, and so on.
• Decrypt Permission
  Users must have decrypt permission to select plain text data from an encrypted column, or to search or join on an encrypted column.
• Restrict Decrypt Permission
  Restrict access to private data from the database owner by setting the restricted decrypt permission configuration parameter.
• Default Values Returned Instead of Decrypted Data
  When users who are not permitted to see confidential data run queries against encrypted columns, they see the decrypt defaults instead of the decrypted data. Decrypt defaults allow legacy applications and reports to run without error, even for users who are not permitted to see confidential data.
• Length of Encrypted Columns
  During create table, alter table, and select into operations, SAP ASE calculates the maximum internal length of the encrypted column. To make decisions on schema arrangements and page sizes, the database owner must know the maximum length of the encrypted columns.
• Encrypted Columns Audits
  You can perform and manage encrypted column audits.
• Performance Considerations
  Encryption is a resource-intensive operation that may introduce a performance overhead to your application in terms of CPU usage and the elapsed time of commands that use encrypted columns.
• Access Encrypted Data
  SAP ASE automatically performs encryption and decryption when you process data in encrypted columns. SAP ASE encrypts data when you update or insert data into an encrypted column, and decrypts data when you select it or use it in a where clause.