Skip to main content
Configure SAP ASE to use the Excrypt HSM as its external keystore, store the HSM credential, and create the HSM key and the master keys that it protects. Run the SQL on this page in isql as an SAP ASE login with sso_role and keycustodian_role. SAP ASE must be running in threaded kernel mode.

​
Enable the external keystore

1

Set the external keystore

Set the external keystore to HSM:
SQL
The output shows external keystore with run value hsm.
2

Store the HSM credential

SAP ASE encrypts the stored credential and passes the password to the library every time it logs in to the HSM. Replace <identity-password> with the password of the identity that you set in <CRYPTO-OPR>:
SQL
SAP ASE stores the credential without testing it, so a wrong password shows up only at the next key operation or restart. Enter it carefully. If your shell or isql tool records history, clear it afterward, or run the command from a file that only you can read with isql -i.
3

Display the stored credential

SQL
SAP ASE reports The current HSM credential setting is: 'lib=libfxpkcs11.so;slot=0' without the password.

​
Create the HSM key

SAP ASE supports one HSM key per server instance. It generates the key on the HSM and records its identifier in the master database.
1

Create the HSM key

SQL
2

Display the HSM key

SQL
The output lists hsm_key as a symmetric hsm key of 256 bits, protected by hsm. On the HSM, the key table contains an AES-256 key with encrypt and decrypt usage and the PKCS #11 label SAP ASE instance key. To list it, run keytable list in FXCLI as an administrator.

​
Protect the master keys with the HSM key

1

Create the server-wide master key

Create the master key in the master database, encrypted with the HSM key:
SQL
2

Create the user database master keys

Create a master key in each user database whose keys the HSM must protect. Replace <database> with the database name:
SQL
3

List the keys

SQL
sybencrmasterkey appears as a symmetric master key protected by hsm key.
If a database already has a master key protected by a password, move it to the HSM key instead: alter encryption key master with passwd '<password>' modify encryption with external key.

​
Encrypt data

Create column encryption keys and database encryption keys as usual. SAP ASE protects them with the master key, which the HSM key protects.
1

Encrypt a column

Create a column encryption key in the user database and use it in the column definition:
SQL
sp_encryption helpkey in the user database lists <column_key> protected by master key.
2

Encrypt a whole database (optional)

Create a database encryption key in master and encrypt the database. Full database encryption runs as background worker tasks, so the server needs worker processes:
SQL
When the background task finishes, sp_helpdb <database> shows encrypted in the database status.