1. Security Guide
  2. Requirements for Data Encryption

Requirements for Data Encryption

You must follow specific restrictions and requirements to bear in mind when encrypting data.

Caution: Do not attempt to change the encryption key length after a Siebel environment has been set up and is running. To do so requires the regeneration of all keys (including the key file), as well as the re-encryption of all the applicable data. Rather, set the key length once during installation. You can, however, use the supported mechanisms to explicitly upgrade the encryption key lengths.

The following requirements exist for data encryption:

  • Because encryption and decryption have performance implications, encrypt only column data that's truly sensitive, such as credit card numbers and social security numbers.

  • Siebel Assignment Manager doesn't decrypt data before making assignments. Assignment rules must take this limitation into consideration.

  • When creating a link object to define a one-to-many relationship between a primary business component and a detail business component, the source and destination fields specified in the link object definition must not be encrypted fields. If encrypted fields are specified, then the Siebel application can't create the association between the two business components. For detailed information on configuring links, see Configuring Siebel Business Applications.

  • Data that's moved into or out of the Siebel database using Siebel EIM isn't encrypted or decrypted by EIM.

    For more information on encrypting EIM data after it's imported into an encrypted column, see .

  • Encrypted data is retrieved, decrypted, and displayed from the fields in the encrypted column when records are selected. Users can perform exact-match queries on the unencrypted values for these fields if you create a hash column to store the hash values.

  • You can only apply AES encryption to data in database columns that are at least 32 bytes long. You can't encrypt database columns of type VarChar that are less than 30 bytes long.

  • Encrypted data requires more storage space in the database than unencrypted data. You must specify appropriate data length for the affected columns. Use the following formulae when you allocate storage space for encrypted data:

    • For ASCII characters, the column size must be: (number of characters * [multiplied by] 2) + [plus] 10.

    • For non-English characters, the column size must be: (number of characters * [multiplied by] 4) + [plus] 10.

    • If you create a Hash Column (to enable search on encrypted data), then specify VarChar as the physical type of the column. The column size must be at least 30 characters; this is a requirement for use of the SHA-2 algorithm.

  • Field-level AES encryption isn't supported for Siebel Developer Web Clients.

  • Encryption isn't supported for List of Values (LOV) columns or multilingual LOV (MLOV) columns.

  • Encryption isn't supported for join columns or foreign key columns.

  • Encryption for a Mobile Web Client.

    Rather than encrypt data using AES encryption, the local database is encrypted. For information about encrypting the local database, see Siebel Remote and Replication Manager Administration Guide. For information about configuring encryption when the Mobile Web Client's local database is synchronized, see Configuring Encryption for Mobile Web Client Synchronization.