Db2 native encryption was introduced in version 10.5 FIX PACK 5 to facilitate data encryption at rest without any hardware, software, and application changes. The following diagram showcases the components of Db2 native encryption.
- The data encryption key (DEK): Db2 encrypts data with a data encryption key before the data is written to disk. The data encryption key is stored, and encrypted, in the database or backup image.
- The encrypted master key: A master key is an encryption key that is used to encrypt a data encryption key (DEK). The data encryption key (DEK) is stored and managed within the database. The master key is stored and managed outside the database. Each database has a single master key and the master key for the database is specified by a label.
- The keystore: The master keys are stored outside the database in a keystore. The keystore can be...