DB2 UDB for z/OS Version 8 Performance Topics - IBM Redbooks

UseServerEncoding data source property. Since there is no disadvantage to using
UseServerEncoding=1, we recommend you should always have this property set, especially if
your DB2 system is using MIXED=NO.
4.8 Data encryption
DB2 V8 ships a number of built-in functions which allow you to encrypt and decrypt data. IBM
also offer an encryption tool called the IBM Data Encryption Tool for IMS and DB2
Databases, program number 5799-GWD, also mentioned in 10.8, “Data Encryption for IMS
and DB2 Databases” on page 369. The performance implications for encryption are roughly
similar to data compression when only considering CPU overhead. In this section, we
introduce both DB2 encryption and the IBM Data Encryption Tool and discuss recent
hardware enhancements that improve encryption performance.
Today, many organizations are paying much more attention to the security of their data, to
comply with various security regulations or as a result of emerging new technologies, for
example, the emergence of the internet, Storage Area Networks (SAN) and more intelligent
storage controllers. (Do you trust your storage vendor not to look at your data?)
However, data encryption has a number of challenges; including making changes to your
application to encrypt and decrypt the data, encryption key management and the
performance overhead of encryption.
Machines prior to the z990 have a Cryptographic Coprocessor Feature to improve the
performance of encryption and decryption. However, only CPU 0 and 1 could perform
encryption. To encrypt and decrypt data, tasks running on other processors need to be
redispatched to run on CPU 0 or 1. Performance is therefore a problem if there is contention
among tasks (for example, parallel query). In addition, dedicated LPARs might not be able to
use the encryption hardware feature.
The z990 introduced a new hardware instruction, CP Assist for Cryptographic Function
(CPACF), which can run on all CPUs and is a feature available only on the z990 hardware and
later, not the older z900. The z990 also introduces a PCIXCC card which is needed for the
IBM Data Encryption Tool, but not for the DB2 encryption function. Now, we briefly introduce
these two encryption functions.
DB2 column level encryption
DB2 V8 ships a number of built-in functions which allow you to encrypt data at the cell level.
These functions are ENCRYPT_TDES (or ENCRYPT), DECRYPT_BIN, DECRYPT_CHAR,
and GETHINT. The SET ENCRYPTION PASSWORD statement allows you to specify a
password as a key to encryption. Because you can specify a different password for every row
that you insert, you can really encrypt data at the cell level in your tables. However, you are
responsible for managing all these keys. So, make sure you have a mechanism in place to
manage the passwords that are used to encrypt the data. Without the password, there is
absolutely no way to decrypt the data. These encryption functions use the Triple Data
Encryption Standard (Triple DES) to perform the encryption.
The DB2 built-in encryption functions require:
► DB2 V8
► Integrated Cryptographic Service Facility (ICSF)
► On z990, CPACF is required (PCIXCC card is not, unless DRDA encryption is necessary)
► Pre-z990, cryptographic coprocessor is required.
188 DB2 UDB for z/OS Version 8 Performance Topics