Managing Protection Policy

Protection policy defines a set of rules that govern the cryptographic operations. The protection policy includes entities such as algorithm, key, and character set.

Protection policy specifications

Supported key types

• For AES algorithm, both versioned and non-versioned symmetric keys are supported.

• For FPE algorithms, both versioned and non-versioned symmetric keys are supported.

The key must be marked exportable on the CipherTrust Manager.

Supported algorithms

FPE requires minimum two characters from the character set to perform crypto operations.

Supported character set

For FPE, the Application Data Protection supports configurable character sets.

Protection Policy versioning

When the Application Data Protection Admin modifies an existing protection policy, a new protection policy with same name is created. This protection policy contains the updated fields and the incremented version. The active flag of the previous versions is set to false. Following fields can be modified:

• Algorithm

• Key

• Character set

• Tweak data

• Initialization vector

If a set of data is already encrypted with a protection policy, ensure to decrypt the data with the same protection policy.

In this article you will learn how to:

• View Protection Policy

• Create Protection Policy

• Modify Protection Policy

• Delete Protection Policy