Protegrity Encryption on

Encryption Properties - IV, CRC, Key ID

Mon, 01 Jan 0001 00:00:00 +0000

The encryption properties include Initialization Vector (IV), Integrity Check (CRC), and Key ID.

For encrypting Unstructured Data using File Protector, you can enable the Key ID property in the encryption data element to be used with unstructured policy.

The following table describes encryption properties.

Table: Encryption Properties

Feature	Description
Initialization Vector (IV)	Encrypting the same value with the IV property will result in different crypto text for the same value.
Integrity Check (CRC)	A type of function that takes as input a data stream of any length and produces as output a value of a certain fixed size. A CRC can be used as a checksum to detect alteration of data during transmission or storage.
Key ID	A Key ID is an identifier that associates encrypted data with the protection method so that the data can be decrypted regardless of where it ultimately resides. A data element can have multiple instances of key IDs associated with it. When the Key ID property is turned on there will be an extra 2 bytes in the beginning of the cipher text. This piece of information contains the reference to the Key ID that was used to produce the cipher text. Caution: It is recommended not to create a large number of keys. All Data Encryption Keys (DEKs) are generated and decrypted using the configured Key Store. This process might take some time and incur costs.

Key IDs

Key IDs are a way to correlate a data element key with its encrypted data. Data elements can have multiple key IDs associated with them. The Key IDs facilitate tasks related to the management of sensitive data such as archiving and key rotation. It is important to note that you can create a maximum number of 8191 keys.

Data Length and Padding in Encryption

Mon, 01 Jan 0001 00:00:00 +0000

Cipher text are formatted in a specific way depending on which encryption properties are being used.

The block ciphers operate on blocks of data. These encryption algorithms require padding. The block size for AES is 16 bytes, and for 3DES it is 8 bytes. The input is always padded, even if it is already a multiple of the block size. Padding ensures that the input data, along with the checksum, if enabled, equals the algorithm’s block size.

Mon, 01 Jan 0001 00:00:00 +0000

The Protegrity solutions can encode data with the following encryption algorithms:

Database Protectors - 3DES, AES-128, AES-256, CUSP.

Table: Input Data Types Supported by Database Protectors

Encryption Algorithm	Oracle	MSSQL
3DES	varchar2	varchar
AES-128	char	char
AES-256	number	decimal
CUSP 3DES	real	real
CUSP AES-128	float	float
CUSP AES-256	date	date
	raw	varbinary
	blob	varbinary(max)
	clob	varchar(max)

Mon, 01 Jan 0001 00:00:00 +0000

The Protegrity solutions can encode data with the following encryption algorithms:

Data Warehouse Protectors - 3DES, AES-128, AES-256, CUSP.

Table: Input Data Types Supported by Data Warehouse Protectors

Encryption Algorithm	Teradata
3DES AES-128 AES-256 CUSP 3DES CUSP AES-128 CUSP AES-256	VARCHAR LATIN CHAR FLOAT DECIMAL DATE VARCHAR UNICODE SMALLINT INTEGER BIGINT JSON XML

Mon, 01 Jan 0001 00:00:00 +0000

The Protegrity solutions can encode data with the following encryption algorithms:

Application Protectors - 3DES, AES-128, AES-256, CUSP.

Table: Input Data Types Supported by Application Protectors

Encryption Algorithm	AP Java^1^2	AP Python	AP C
3DES AES-128 AES-256 CUSP 3DES CUSP AES-128 CUSP AES-256	STRING CHAR[] BYTE[]	STRING BYTES INT LONG FLOAT	STRING CHAR[] BYTE[]

^*1 - If the input and output types of the API are BYTE [], the customer application should convert the input to a byte array. Then, call the API and convert the output from the byte array.