Skip to main content
Configure SAP ASE to use CryptoHub as its external keystore, store the HSM credential, and create the HSM key and the master keys that it protects. Run the SQL on this page in isql as an SAP ASE login with sso_role and keycustodian_role. SAP ASE must be running in threaded kernel mode.

​
Enable the external keystore

1

Set the external keystore

Set the external keystore to HSM:
SQL
The output shows external keystore with run value hsm.
2

Store the HSM credential

SAP ASE encrypts the stored PIN and uses it every time it starts. Replace <endpoint-pin> with the CryptoHub endpoint PIN that you moved out of fxpkcs11.cfg:
SQL
SAP ASE stores the credential without testing it, so a wrong PIN shows up only at the next key operation or restart. Enter it carefully, and clear the isql session history afterward if your shell or tool records it.
3

Display the stored credential

SQL
SAP ASE reports The current HSM credential setting is: 'lib=libfxpkcs11.so;slot=0' without the PIN.

​
Create the HSM key

SAP ASE supports one HSM key per server instance. It creates the key in CryptoHub and records its UUID in the master database.
1

Create the HSM key

SQL
2

Display the HSM key

SQL
The output lists hsm_key as a symmetric hsm key of 256 bits, protected by hsm, with a 32-character UUID. In the CryptoHub Key Management menu, the service key group (for example, SAP ASE-Sym) contains one AES-256 key whose name starts with SAP ASE instance key.

​
Protect the master keys with the HSM key

1

Create the server-wide master key

Create the master key in the master database, encrypted with the HSM key:
SQL
2

Create the user database master keys

Create a master key in each user database whose keys CryptoHub must protect. Replace <database> with the database name:
SQL
3

List the keys

SQL
sybencrmasterkey appears as a symmetric master key protected by hsm key.
If a database already has a master key protected by a password, move it to the HSM key instead: alter encryption key master with passwd '<password>' modify encryption with external key.

​
Encrypt data

Create column keys and database encryption keys as usual. SAP ASE protects them with the master key, which the HSM key in CryptoHub protects.
1

Encrypt a whole database

Create a database encryption key in master and encrypt the database. Full database encryption runs as background worker tasks, so the server needs worker processes:
SQL
When the background task finishes, sp_helpdb <database> shows encrypted in the database status.
2

Encrypt a column

Create a column encryption key in the user database and use it in the column definition:
SQL
sp_encryption helpkey in the user database lists <column_key> protected by master key.