Translate File Encryption Key - Field Procedure (TRNFILKEYF)

The Translate File Encryption Key - Field Procedure (TRNFILKEYF) command allows authorized users to translate (re-encrypt) field values in a file (when a Pending Key has been entered) to the new pending Keys previously entered.

NOTE:
  • TRNFILKEYF can be used for *ACTIVE field entries which use a DB2 Field Procedure for automatic encryption/decryption.
  • It is recommended to submit this command to batch using the SBMJOB command.
  • TRNFILKEYF will attempt to get an exclusive lock on the file, so no users or applications should be using the file at the time.
  • The execution time for TRNFILKEYF depends on the number of records which it must translate (re-encrypt) to the new Key.

For each record found, TRNFLDKEYF will decrypt the value with the old key and re-encrypt the value using the new key specified.

The following users can use this command:

  • QSECOFR user profile (unless excluded in the Key Officer settings)
  • A user profile with *SECADM authority (unless excluded in the Key Officer settings)
  • A Key Officer whom has a *YES specified for the "Maintain Field Enc. Registry" authority setting

This command requires that you have *CHANGE authority to the CRVL002 Validation List (*VLDL) object which contains the Field Encryption Registry.

This command requires that you have *USE authority for the Key Stores that contain both the current and new encryption/decryption Keys.

IMPORTANT: Before using the TRNFILKEYF command to encrypt production data, do the following steps:
  1. Make sure you have *ALL authority to the database file containing the field to decrypt.
  2. Within a test environment, you should have tested TRNFILKEYF.
  3. No applications or users should be currently using the database file containing the field to translate.
  4. The TRNFILKEYF command will perform a mass re-encryption of the current field values. You should allocate enough downtime for the TRNFLDKEYF to execute. Execution times will vary depending on the processor speed of your system, the number of records in your database file, and other activity running on the system at the time. In order to estimate the execution time for TRNFILKEYF, you should run the TRNFILKEYF command over some test data first.

The TRNFILKEYF command performs the following primary steps:

  1. Obtains an exclusive (*EXCL) lock on the database file containing the field to translate.
  2. Optional: Creates a backup of the database file (containing the field to encrypt) into a Save file named BACKUPxxxxx, where xxxxx is a sequential number from 1 to 99999.
  3. Changes the status of the field to *PROCESS.
  4. Reads all records in the file and re-encrypts the field values to the new key entered.
  5. Changes the *CURRENT keys in the field registry to the Pending keys previously entered.
  6. The exclusive lock will be released on the database file containing the encrypted fields.
  7. The status of the field entry will be changed to *ACTIVE.

How to Get There

In the Field Keys Menu, choose option 6. Or, in the File Field Encryption Menu, choose option 5.

Options

File name (TRNFILE)

Specify the name of the file that contains the field(s) to translate.

The possible values are:

file-name The name of the file that contains the field(s) to translate.

The possible library values are:

library-name Enter the name of the library where the file is located.
*LIBL Locate the file within the library list.
Save database file (SAVDTA)

Indicate if the database file (containing the field to encrypt) should be saved (backed up) into a Save File before the translation process begins. It is highly recommended to save the database file for error recovery purposes.

The possible values are:

*YES Save the database file into a Save File before translation begins.
NOTE:
  • The created Save File will be named BACKUPxxxxx, where xxxxx is a sequential number from 1 to 99999.
  • Before using this option, ensure that enough disk space is available for a saved copy of the database file.
*NO Do not save the database file before the translation process begins.