Changing Db2 data sets from encrypted to unencrypted

To allocate a data set as unencrypted, make sure the key label is not specified through the RACF data set profile or one of the DFSMS methods.

Procedure

To change a Db2 data set from encrypted to unencrypted, choose one of the following options:

  1. For log, catalog, or directory data sets, complete the following steps:
    1. Set the subsystem parameter ENCRYPTION_KEYLABEL to blank.
    2. Issue the SET SYSPARM command to cause the new ENCRYPTION_KEYLABEL value to take effect.
      Db2 does not pass the ENCRYPTION_KEYLABEL value to DFSMS for allocation of new data sets for archive logs.
    3. Run the REORG TABLESPACE utility against the catalog and directory table spaces.
  2. For user objects, complete the following steps:
    1. Issue ALTER TABLE or ALTER STOGROUP with the NO KEYLABEL clause for both the table and containing storage group.
    2. Run the REORG TABLESPACE utility against the table spaces associated with the table.