Encrypted Fields Configuration
Note: You must run F1-ENCRS and/or F1-ENCRT after adding or updating encryption to reflect the changes.
To define a field to encrypt, add an option with the following attributes:
Attribute
Description
Option Type
Set to Field Encryption.
Sequence
Set to a number not in use. High sequence numbers override low sequences.
Value
Specify the encryption in the format of a command string. For example, table="F1_ATTACHMENT",field="PK_VAL5",alias="ouaf.system",encryptedField="PK_VAL2",hashAlias='HmacSHA256-1024',hashField="PK_VAL3", where="PK_VAL1='Encrypted'".
 
• table - A table name existing in the metadata.
• field - An existing field in the metadata that will be encrypted. Must only be in a string format, other field formats are not supported. Using a higher level of encryption may increase the field’s storage requirements.
• alias - Keystore alias to encrypt the data.
• where - Data filter, useful for child tables to determine specific values to encrypt. Do not use for adhoc characteristics
• wrap - Specifies whether to wrap or not the value with the ENC() market. Valid values are true and false. Set to “false” unless your code includes additional processing that handles the special marker. OUCS fields should use wrap=false.
• maskAlg - The algorithm to mask the data if the field will also be masked. For example, maskAlg=”CMCCR”
• maskField - The field to use as the mask if the field will also be masked. For example, maskField=”CNBR_MASK”
• hashAlias - Keystore alias to use if hashing the field for additional verification and indexing values.
• hashField - The field to use as the hash value if hashing the field for additional verification and indexing values.
• encryptedField - The field name to use when storing the encryption output to another field in the table. Add when using a higher level of encryption to hold the larger encrypted value.