IBM Db2
TMA-DB2-8.2.9
Rotate the Master Key
Description
Key rotation refers to the process of changing encryption keys and is often required for compliance purposes. Similar to a password change, key rotation is done to reduce the risk that can come from exposure of the key, while it exists. Since the DEK used by Db2 for encryption is never outside of the encrypted database, backup, or transaction log, there is little risk of exposure. The same is ...
Méthode de vérification
Méthode d'audit: Revue manuelle
Check the current database is encryption settings: db2 => SELECT * FROM TABLE(SYSPROC.ADMIN_GET_ENCRYPTION_INFO()) You must be connected to the database to run this command. The following information will be shown for the connected database: ; OBJECT_NAME ; OBJECT_TYPE ; ALGORITHM ; ALGORITHM_MODE ; KEY_LENGTH ; MASTER_KEY_LABEL KEYSTORE_NAME KEYSTORE_TYPE ; KEYSTORE_HOST KEYSTORE_IP ; KEYSTORE_IP_TYPE ; PREVIOUS_MASTER_KEY_LABEL AUTH_ID ; APPL_ID ; ROTATION_TIME
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
The SYSPROC.ADMIN_ROTATE_MASTER_KEY procedure can be used to change the database key to comply with key rotation requirement. You must be connected to the database to run this command. db2 => CALL SYSPROC.ADMIN_ROTATE_MASTER_KEY('newMasterKeyLabel') Db2 will automatically generate the new MK and label unless you provide a MK label for an existing MK. Key rotation is logged in the db2diag.log file: $ grep -A 3 "Key Rotation" ~/sqllib/db2dump/db2diag.log Key Rotation successful using label: DATA #2 : String, 46 bytes DB2_SYSGEN_db2inst1_SECRET_2021-04-29-11.22.01 The DEK is not externalized and does not need to be rotated. However, if you wish to rotate the DEK you can take an offline backup and restore to a new encrypted database, thus generating a new DEK.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- db2databasemanual
- Référence
- CIS IBM Db2 12.1 Benchmark v1.0.0 - 8.2.9 Rotate the Master Key