Downgrading an Adaptive Server that Uses Encryption

Perform these steps to downgrade an Adaptive Server versions 15.7 and later if you enabled 256-bit key encryption keys.

1. Set the downgrade_kek_size configuration option to true. This means you must change the key encryption key size to 128 bits.
2. Run sp_downgrade to find all column encryption keys (CEKs) and key copies that are protected by master keys or by dual control.
3. Drop dual control for each CEK:

   alter encryption key keyname 
           [with passwd password
           modify encryption
           with no dual_control

4. Use drop encryption key to drop user and login password-protected key copies.
5. Create a system encryption password for each database that has master keys:

   sp_encryption system_encr_passwd, <password>

6. Re-encrypt each CEK with the master key:

   alter encryption key keyname
           with passwd master key
           modify encryption
           with passwd system_encr_passwd

   Note: The key owner must perform the re-encryption for each CEK, or else the key ownership changes.
7. Re-encrypt all base keys that are protected by user passwords:

   alter encryption key keyname
           with passwd old_password
           modify encryption
           with passwd new_passwd

   Note: The key owner must perform the re-encryption for each base key, or else the key ownership changes.