isql as an SAP ASE login with sso_role and keycustodian_role. This page uses a user database named <database> with a table that has an encrypted column, as created in Configure SAP ASE and create the HSM key.
Confirm the key hierarchy
1
Display the keys
Display the keys in
master and in the user database:SQL
master lists hsm_key protected by hsm and sybencrmasterkey protected by hsm key. The user database lists its own sybencrmasterkey protected by hsm key and its column keys protected by master key.2
Write and read the encrypted column
SQL
The query returns the plaintext value. SAP ASE decrypted the master key through the HSM to use the column key.
Confirm restart recovery
1
Restart SAP ASE
Run
shutdown in isql, and then start SAP ASE from its RUN file as the SAP ASE account. Replace <server> with the SAP ASE server name:Shell
2
Read the encrypted column again
SQL
The query returns the plaintext value. After the restart, SAP ASE loaded the library, logged in to the HSM with the stored credential, and decrypted the master key again. The SAP ASE error log has no
Cryptoki API errors.3
Regenerate the master key
Regenerate the server-wide master key under the HSM key. This step also confirms the stored credential, because SAP ASE must decrypt and encrypt the master key through the HSM:
SQL
The command completes without an error, and
sp_encryption helpkey still lists sybencrmasterkey protected by hsm key.Confirm that SAP ASE fails closed
1
Store a wrong password
Store a wrong password in the HSM credential, then restart SAP ASE:
SQL
After the restart, the SAP ASE error log reports
Call to Cryptoki API 'C_Login' failed with error code 160 (0xa0) CKR_PIN_INCORRECT. A query on the encrypted column returns Msg 15432: A validation check failed when Adaptive Server decrypted an encryption key, and sp_helpdb shows a fully encrypted database as offline, encrypted. SAP ASE can’t use its keys without the HSM.2
Restore the password
Restore the correct password and bring any offline database online:
SQL
SAP ASE reports
Database '<database>' is now online, and the encrypted column returns plaintext values.Return to production logging
If you enabled traffic logging during setup, set<LOG-MODE> to ERROR and <LOG-TRAFFIC> and <LOG-TEMPLATES> to NO in /etc/fxpkcs11.cfg. SAP ASE reads the file when it loads the library, so restart SAP ASE for the change to take effect.