isql as an SAP ASE login with sso_role and keycustodian_role. This page uses a fully encrypted test database named <database> with a table that has an encrypted column.
Confirm the key hierarchy
1
Display the keys
Display the keys in
master and in the user database:SQL
master lists hsm_key protected by hsm and sybencrmasterkey protected by hsm key. The user database lists its own sybencrmasterkey protected by hsm key and its column keys protected by master key.2
Read the encrypted column
SQL
The query returns the plaintext values.
Confirm restart recovery
1
Restart SAP ASE
Run
shutdown in isql, and then start SAP ASE from its RUN file as the SAP ASE account. Replace <server> with the SAP ASE server name:Shell
The SAP ASE error log reports
Recovering database '<database>' and then Database '<database>' is now online, and sp_helpdb <database> shows encrypted without offline. The encrypted column returns plaintext values again. SAP ASE decrypted the master keys through CryptoHub during startup.2
Regenerate the master key
Regenerate the server-wide master key under the HSM key:
SQL
The command completes without an error, and
sp_encryption helpkey still lists sybencrmasterkey protected by hsm key.Confirm that SAP ASE fails closed
1
Store a wrong PIN
Store a wrong PIN, then restart SAP ASE:
SQL
After the restart,
sp_helpdb <database> shows the database as offline, and the error log reports Call to Cryptoki API 'C_Login' failed with error code 160 (0xa0) CKR_PIN_INCORRECT. SAP ASE can’t open the encrypted database without CryptoHub.2
Restore the PIN
Restore the correct PIN and bring the database online:
SQL
SAP ASE reports
Database '<database>' is now online, and the encrypted column returns plaintext values.