The impact of encryption on database operations

In addition to keystore availability and recoverability issues, there are other factors that can impact your database operations that you need to consider before encrypting a database.

The following section outlines changes that encryption can introduce to a production database environment, and how to plan for them.

Management of keystore credentials

As part of its own protection mechanisms, the keystore that is used by Db2® has its own authentication requirements. Users that attempt to access the keystore need to present valid credentials. Db2 needs access to these credentials to initiate connections to the keystore. How these credentials are stored and made available to Db2 in your environment needs to be considered. See the topics Keystore selection and Keystore configuration for information on choosing and setting up a keystore.

Keystore archiving and retention

While you must keep the keystore contents protected, you must also ensure that you keep all the master keys for the lifetime of any database backups and logs that you create. To recover an old backup and roll-forward through its related logs, you need the master key(s) that were used at the time that the backup and logs were created.

Potential change in storage requirements for archived logs and database backups

Many Db2 customers rely on data deduplication techniques, provided by their media devices, to minimize the size of archived transaction logs and database backups. But compression works by finding repeating patterns in data, while encryption randomizes data. Because of this conflict, the compression of an encrypted object does not reduce the objects size. As a result, you might need to change your approach in this area by considering how to compress before encrypting your database, This could be done using active compression within Db2 or by using the combined compression and encryption backup library provided with Db2.

Keystore coordination between HADR databases

If you have an HADR system, both the primary and standby databases need to be encrypted. You will need to consider how the keystore is shared between the sites.