DB2 UDB for z/OS Version 8 Performance Topics - IBM Redbooks

Each CP on the z990 has an assist processor on the chip in support of cryptography. This
feature provides for hardware encryption and decryption support. Peripheral Component
Interconnect Extended Cryptographic Coprocessor (PCIXCC) provides a cryptographic
environment with added function. The PCIXCC consolidates the functions previously offered
on the z900 by the Cryptographic Coprocessor feature (CCF) and the PCI Cryptographic
Coprocessor (PCICC) feature. For a more detailed discussion of CPACF and PCIXCC, refer
to the book IBM eServer zSeries 990 (z990) Cryptography Implementation, SG24-7070.
Applications implementing DB2 encryption must apply the DB2 encrypt and decrypt built-in
functions for each column to be encrypted or decrypted. All encrypted columns must be
declared “for bit data”. So, unchanged read-applications see data in encrypted form.
Applications may apply a different key for each column, but may also supply the key in a
special register. It is strongly recommended for performance to specify the key in the special
register.
LOAD and UNLOAD utilities do not support DB2 encryption, but SQL-based programs such
as DSNTIAUL do support encryption. Encryption of numeric fields is not supported. The
length of encrypted columns must allow for an additional 24 bytes, rounded up to a double
word boundary. So, space usage may be a concern if you plan to use DB2 to encrypt small
columns.
Indexes are also encrypted. Predicates that depend on the collating sequence of encrypted
columns, (for example range predicates), may produce wrong results (unless modified to use
built-in functions correctly). For example:
SELECT COUNT(*) WHERE COL = :HV;
produces wrong results.
SELECT COUNT(*) WHERE COL = ENCRYPT_TDES(:HV);
produces correct results and almost no impact to performance.
SELECT COUNT(*) WHERE COL < ENCRYPT_TDES(:HV);
produces wrong results.
SELECT COUNT(*) WHERE DECRYPT_CHAR(COL) < :HV;
produces correct results with large impact on performance.
IBM Data Encryption Tool for IMS and DB2 Databases
IBM also offers an encryption tool called IBM Data Encryption Tool for IMS and DB2
Databases. This tool performs row level encryption using EDITPROCs. Unlike the DB2
encryption functions shipped with DB2, the Data Encryption Tool uses different keys to
encrypt different tables. The encryption keys can be either clear, like the DB2 encryption
functions, or secure and they are managed through ICSF (Integrated Cryptographic Service
Facility). Clear keys are generally better performing. The tool also supports single, double, or
triple DES. Once again, refer to the book, IBM eServer zSeries 990 (z990) Cryptography
Implementation, SG24-7070, for a more detailed explanation of clear keys and secure keys.
You can find more information about the IBM Data Encryption Tool for IMS and DB2
Databases by visiting the Web site at:
http://www.ibm.com/software/data/db2imstools/db2tools/ibmencrypt.html
The IBM Data Encryption Tool for IMS and DB2 Databases supports all versions of DB2 but
only encrypts the whole row. No application changes are required, however the DDL must be
modified to include the EDITPROC. The applications do not need to be aware of encryption
keys.
Chapter 4. DB2 subsystem performance 189