Default Values Returned Instead of Decrypted Data

When users who are not permitted to see confidential data run queries against encrypted columns, they see the decrypt defaults instead of the decrypted data. Decrypt defaults allow legacy applications and reports to run without error, even for users who are not permitted to see confidential data.

• Defining Decrypt Defaults
  The decrypt_default parameter for create table and alter table allows an encrypted column to return a user-defined value when a user without decrypt permission attempts to select information from the encrypted column.
• Permissions and Decrypt Default
  You must grant decrypt permission on encrypted columns before users or roles can select or search on encrypted data in those columns. If an encrypted column has a decrypt default attribute, users without decrypt permission can run queries that select or search on these columns, but the plain text data is not displayed and is not used for searching.
• Columns with Decrypt Default Values
  There are no restrictions on how you use columns with decrypt default in a query. You can use them in a target list expression, where clause, order by, group by, or subquery.
• Decrypt Default Columns and Query Qualifications
  If you use a column with the decrypt default property in a where clause, the qualification evaluates to false if you do not have decrypt permission.
• decrypt default and Implicit Grants
  If you do not have explicit or implicit permission on a table, SAP ASE returns the decrypt default value.
• decrypt default and insert, update, and delete Statements
  The decrypt default parameter does not affect target lists of insert and update statements. If you use a column with a decrypt default value in the where clause of an update or delete statement, SAP ASE may not update or delete any rows.
• Removing Decrypt Defaults
  Multiple commands allow you to remove decrypt defaults.