Add Field Encryption Entry (ADDFLDENC)
The ADDFLDENC command allows authorized users to add a new entry into the Field Encryption Registry.
The following users can use the ADDFLDENC command:
- QSECOFR user profile (unless excluded in the Key Officer settings)
- A user profile with *SECADM authority (unless excluded in the Key Officer settings)
- A Key Officer that has a *YES specified for the “Maintain Field Enc. Registry” authority setting
This command requires that you have *CHANGE authority to the CRVL002 Validation List (*VLDL) object, which contains the Field Encryption Registry, and *USE authority to the library that contains the Key Store.
How to Get There
From the Work with Field Encryption Registry (WRKFLDENC) panel, press F6, Add. Or, prompt (F4) the command CRYPTO/ADDFLDENC.
Field Descriptions
Field identifier (FLDID)
Indicate the unique name of the entry up to 30 characters.
Rules for field identifier:
- The field identifier does not have to be the same name as the database field name to encrypt.
- The field identifier cannot contain spaces or certain special characters.
- The field identifier can contain underscore characters.
- The field identifier is not case sensitive. It will be stored in upper case.
Database field name (DBFLD)
Indicate the actual name of the database field to register for encryption. A field name up to 30 characters is supported.
The possible values are:
Database file name (DBFILE)
Indicate the name and library of the database file which contains the field to register.
Database field type (DBFLDTYP)
Indicate the data type of the database field.
The possible values are:
While defining a field of the type ‘Graphic’ or ‘VarGraphic’, choose *CHAR for Database Field Type. The Database Field Length should reflect the Buffer Length of the field (as shown in DSPFFD for this file/field) as opposed to the defined field length.
Database field length (DBFLDLEN)
Indicate the length of the values within the database field to encrypt.
For *CHAR type fields, the maximum allowable length is 32624.
For VARCHAR, the length parameter must be the length of the DB2 field plus 2 bytes (to accommodate the end-of-string delimiter).
For *DEC type fields, the maximum allowable length is 30.
If not using a DB2 Field Procedure and if you only want to encrypt a left portion of an alphanumeric field, then you can specify a length that is less than the actual field length.
Database field decimal pos (DBFLDDEC)
For *DEC type database fields, indicate the number of decimal positions (scale) in the field. Allowable range is 0 to 4.
Encryption key label (ENCKEYLBL)
Indicate the label of the initial key to use for encrypting the field values.
Encryption key store name (ENCKEYSTR)
Indicate the object name and library of the Key Store which contains the Symmetric Key to use for encryption of the field.
The users (or user groups) which need to encrypt values will need to have at least *USE authority to this Key Store object.
The possible values are:
The possible library values are:
Decryption key label (DECKEYLBL)
Indicate the label of the initial key to use for decrypting the field values.
The possible values are:
Decryption key store name (DECKEYSTR)
Indicate the object name and library of the Key Store which contains the Symmetric Key to use for decryption of the field.
The users (or user groups) that need access to the decrypted values will need to have at least *USE authority to this Key Store object.
The possible values are:
The possible library values are:
Encryption algorithm (ALGORITHM)
Indicate the encryption algorithm to use for encrypting and decrypting the database field values.
This should match the algorithm used to create the Symmetric Key specified on the ENCKEYLBL parameter.
The possible values are:
Algorithm mode (MODE)
Indicate the mode to use within the encryption algorithm.
The possible values are:
Initialization vector (INITVECTOR)
Optional. The Initialization Vector (IV) is an arbitrary value that you can enter, which will be used as an additional input to the encryption algorithm. Therefore, the encrypted output is dependent on the combination of the Initialization Vector, Encryption Key and the Plain Text (the data you want to encrypt).
The Initialization Vector is allowed for *CBC and *CUSP algorithm modes.
The length of the Initialization Vector must not exceed the block length, which is calculated as:
- 32 bytes for *AES algorithm and *CUSP mode
- 16 or 24 bytes for *AES algorithm and *CBC mode
- 8 bytes for *TDES algorithm and *CBC mode
Mask option (MASKOPT)
Indicate the mask option to use for the field when the masked value is requested on a decrypt operation.
The possible values are:
- String ' 1234567890123456' is masked as ' 1234999999993456'
- String '1234567890123456 ' is masked as '1234999999993456 '
- Numeric 001234567890123456 is masked as 001234999999993456
- Numeric 1234567890123456 is masked as 1234999999993456
If you are not using field procedures, a non-numeric character can be used, for example:
- String ' 1234567890123456' is masked as ' 1234########3456'
- String '1234567890123456 ' is masked as '1234########3456 '
- Numeric 001234567890123456 is masked as 001234########3456
- Numeric 1234567890123456 is masked as 1234########3456
- Date '9999-12-31'
- Time '24.00.00'
- TimeStamp '9999-12-31-24.00.00.000000'
Field mask (FLDMASK)
Indicate the masking format to apply to the field when the masked value is requested on a decrypt operation. Valid for MASKOPT(*OPTION1) and MASKOPT(*OPTION3) masking.
- For MASKOPT(*OPTION1) masking
Specify the number 9 in a position to show the underlying value for that position. Specify any other character (including spaces) or number in a position to mask the underlying value for that position.
For example, if a mask of '************9999' is specified for a credit card number, then a sample of a masked credit card number would be '************1234'.
As another example, if a mask of '##99##999' is specified for an account number, then a sample of a masked account number would be '##76##541'.
When the field type is numeric the whole number is masked. The decimals values are not. The Mask must not be longer than the whole number length. When using field procedures the mask value must be numeric. For example, if a mask of '779977999' is specified for an account number, then a sample of a masked account number would be '774577541'.
- For MASKOPT(*OPTION3) masking
You must enter in a valid Date, Time or Timestamp value. This will be the value used as the mask.
Examples:
- Date '9999-12-31'
- Time '24.00.00'
- TimeStamp '9999-12-31-24.00.00.000000'
Used for Date, Time and Timestamp fields. The value entered will be used as the mask value. The mask value must be a proper Date, Time or Timestamp value for the field being masked.
It is recommended to specify a mask value that does not conflict with an existing value in your database. For instance, for a date field, you may want to specify a mask value with a high value date of 9999-12-31.
The format of the mask value must be in the format of the field format. For example if the "Date Format" of a field is *ISO, then the format of the masked value must be *ISO.
Examples:
- Date '9999-12-31'
- Time '24.00.00'
- TimeStamp '9999-12-31-24.00.00.000000'
Char/Digits to show on left (DIGLEFT)
When a masked value is requested on a decrypt operation, indicate the number of characters or digits to show on the left side of the field value. Valid for MASKOPT(*OPTION2) masking.
For a character field, any leading blank characters will be ignored when performing the masking. For a decimal field, any leading zeros will be ignored.
Char/Digits to show on right (DIGRIGHT)
When a masked value is requested on a decrypt operation, indicate the number of characters or digits to show on the right side of the field value. Valid for MASKOPT(*OPTION2) masking.
For a character field, any trailing blank characters will be ignored when performing the masking.
Masking Value (FLDMASKV)
The value to be used as the masking character or number. Valid for MASKOPT(*OPTION2) masking. When masking a numeric field and using DB2 Field Procedures, the mask value must be a number between 0 and 9. When masking a character field, or when masking a numeric field and not using DB2 Field Procedures, the mask value can be any character or number.
Auth. list for full value (AUTLDEC)
Indicate the IBM i Authorization List that should be used to determine which users have authority to the full field values on decrypt operations.
This Authorization List will be used in field decryption APIs and DB2 Field Procedures.
The possible values are:
Auth. list for masked value (AUTLMASK)
Indicate the IBM i Authorization List that should be used to determine which users have authority to the masked field values on decrypt operations.
This Authorization List will be used in field decryption APIs and DB2 Field Procedures.
The possible values are:
Auth. list caching (AUTLCACHE)
Indicate if the permissions for authorization lists are 'cached' in memory.
The possible values are:
Not authorized fill value (NOTAUTHFV)
Indicate the 1-byte value to fill the returned value on a decryption request (from a DB2 Field Procedure or a Powertech Encryption 'auth' API) if the user is not authorized to either the full or masked authorization lists.
For instance, if the fill value is '9' and the field length is 7, then the value of '9999999' will be returned on an unauthorized decryption request.
- The fill value is required when a DB2 Field Procedure is utilized and the return value (FLDPROCOPT) is set to *AUTH.
- If the field type is *CHAR, then the fill value can be a number, letter or special character (e.g. #, *, %).
- If the field type is *DEC, then the fill value can be a number from 1 through 9 if a DB2 Field Procedure is being utilized, otherwise it can be number from 0 through 9.
- The fill value is not allowed for field types of *DATE, *TIME and *TIMESTAMP.
Store values in external file (STREXTFILE)
Indicate if the encrypted field values should be stored in a separate external file.
The encrypted values must be stored in an external file if not using a DB2 Field Procedure and if any of the following conditions are met:
- If the field type is *DEC.
- For *AES128, *AES192 and *AES256 algorithms with *CBC or *ECB modes: If the field type is *CHAR and the length specified for DBFLDLEN is not divisible by 16 or 24.
- For *TDES algorithm: If the field type is *CHAR and the length specified for DBFLDLEN is not divisible by 8.
The possible values are:
External file name (EXTFILE)
Indicate the name and library of the external physical file which will be created to contain the encrypted field values.
The possible values are:
The possible library values are:
The external physical file will be keyed by the Field Identifier
(XXFLDID) and the Index Number (XXINDEX).
External logical file name (EXTFILEL)
Indicate the name and library of the logical file which will be built over the external physical file, which will be keyed by the
Field Identifier (XXFLDID) and the Encrypted Value (XXVALUE).
The possible values are:
This object name must NOT already exist.
The possible library values are:
Store hash for security check (EXTSTRHASH)
Indicate if a HASH value should be stored for each record in the external file.
The possible values are:
The possible values are:
Align index number (INDEXALIGN)
When encrypting a character (alphanumeric) type field which is stored in an external file, then indicate how the external index number should be aligned in the field.
The possible values are:
Index padding character (INDEXPAD)
When encrypting a character (alphanumeric) type field, indicate a padding character to place in the unused positions of the field.
For instance, if a padding character of "*" is specified with an alignment of *LEFT, then a 10 position field value with an index of 895 would appear as "895*******".
The padding character cannot be a number, a single quote (') or a dash (-).
Last index number storage (LSTINDSTG)
Indicate the object type to store the 'last index number used'. Each time a record is written (inserted) to the external file, the 'last index number used' is retrieved from the object, increased by 1, assigned to the new record and saved back to the object.
The possible values are:
Use triggers to auto encrypt (USETRG)
Indicate if SQL triggers should be created over the database file, which will automatically encrypt the database field values without having to change your applications.
Note that SQL triggers are not allowed for encryption if a DB2 Field Procedure is already specified with USEFLDPROC(*YES).
The possible values are:
They are mutually exclusive.
Trigger name for inserts (INSTRG)
Indicate the name and library of the trigger to create. This trigger will be used to automatically encrypt the field value when records are inserted (added) into the database.
The possible values are:
- The trigger name cannot exceed 80 characters in length.
- The trigger name cannot be the same name as a trigger that is already on the database file.
- The trigger name cannot contain spaces or certain special characters.
- The trigger name can contain underscore characters.
- The trigger name is not case sensitive. It will be stored in upper case.
The possible library values are:
Trigger name for updates (UPDTRG)
Indicate the name and library of the trigger to create. This trigger will be used to automatically encrypt the field value when records are updated in the database.
This is a column trigger, so it is only called when the particular field value is changed.
The possible values are:
- The trigger name cannot exceed 80 characters in length.
- The trigger name cannot be the same name as a trigger that is already on the database file.
- The trigger name cannot contain spaces or certain special characters.
- The trigger name can contain underscore characters.
- The trigger name is not case sensitive. It will be stored in upper case.
The possible library values are:
Trigger name for deletes (DLTTRG)
This is only valid if an external file is used to store the encrypted values: Indicate the name and library of the trigger to create.
This trigger will be used to automatically remove the encrypted field value (record) from the external file when a database record is deleted.
The possible values are:
- The trigger name cannot exceed 80 characters in length.
- The trigger name cannot be the same name as a trigger that is already on the database file.
- The trigger name cannot contain spaces or certain special characters.
- The trigger name can contain underscore characters.
- The trigger name is not case sensitive. It will be stored in upper case.
"FILENAME_FIELDNAME_CryptoDelete".
The possible library values are:
Trigger exit type (TRGEXITTYP)
Indicate if the triggers should call a custom exit program before performing any inserts, updates or deletes of the field value.
Listed below are some examples of how a Trigger exit program could be utilized:
- To write out additional audit entries in the audit journal file.
- To direct Powertech Encryption to not process (ignore) the requested insert/update/delete of the field value based on custom criteria, such as the user id or application performing the request.
- To perform additional custom logic.
A trigger exit program can be written in RPG, COBOL or C on the System i. Source examples of RPG trigger programs are provided in the members of TRGEXTPGM and TRGEXTSRV within the source file of CRYPTO/QRPGLESRC.
The possible values are:
Trigger exit program (TRGEXITPGM)
Indicate the name and library of the trigger exit program to call.
The possible library values are:
Trigger exit procedure (TRGEXITPRC)
Indicate the name of the procedure to call if the TRGEXITTYP is *SRVPGM.
Use DB2 field procedure (USEFLDPROC)
Indicate if a DB2 Field Procedure will be used to automatically encrypt/decrypt the field values, which is an alternative approach to using triggers and API calls. A DB2 Field Procedure also allows storing the 'encoded' encrypted values within the existing file, which is especially useful for numeric fields. [You will not need to create a separate external file to store the values for numeric fields.]
DB2 Field Procedures are available in IBM i version V7R1 and higher.
Before using DB2 Field Procedures in a production environment, read the Installation Guide and User Guide to understand the potential performance issues and risks.
The possible values are:
Field procedure return value (FLDPROCOPT)
Indicate which field value is returned (based on user permissions) from the DB2 Field Procedure to the application on a read operation.
The possible values are:
Decryption Accelerator (PERFACCEL)
Allows Powertech Encryption for IBM i to apply methods to attempt to improve performance gains when possible with native i/o.
The possible values are: