Creating protection policy

To create a protection policy:

1. Open Application Data Protection.

2. In the left pane, click Protection Policies.

3. On the Protection Policies screen, click Add Protection Policy.

4. On the Create Protection Policy screen, enter/select the following fields.

   Field	Description
   Name	Unique name for protection policy.
   Luhn	If enabled, protection policy is configured to protect luhn complaint data. Note Luhn check is only compatible with All digits character set (0-9) and FPE algorithms. It requires minimum 3 characters to perform crypto operations.
   Algorithm	Algorithm to be used in the cryptographic operations. You can view the list of supported algorithms here.
   Key	Key to be used in the cryptographic operations.
   Character Set	Name of the character set. Refer to Creating Character Sets for details.
   Access Policy	Access policy to be associated with the protection policy. Access policies are set of rules that define how the decrypted data will be revealed to the application users. For more details, click here.
   Masking Format	Static masking format to be associated with the protection policy. For more details, click here.
   Tweak Algorithm	Tweak algorithm to be used in cryptographic operations. It is only applicable for FPE algorithms. Possible options are: — SHA1 — SHA256 — NONE — NULL Note For FF3 variants, Tweak Algorithm can't be NULL. For the remaining FPE algorithms, Tweak Algorithm can be NULL.
   Tweak	Tweak data to be used in cryptographic operations. To know the required size of tweak data for FPE and tweak algorithms, click here.
   IV	Initialization vector to be used in cryptographic operations. IV is applicable and required for the following algorithms: — AES/CBC/NoPadding: 16-bytes (any UTF-8 character input) IV — AES/CBC/PKCS5Padding: 16-bytes (any UTF-8 character input) IV — FPE/AES: The IV should be specified as Hex-encoded value; where, each Hex value is represented by 2 characters. For FPE/AES, the IV length is dependent on the cardinality of the character set. To know the required IV length, click here.
   Prefix	Specify a user friendly name to help user identify the type of data being protected. The maximum allowed length for prefix is 7 characters and only All Printable ASCII characters are allowed.
   Disable Versioning	If selected, protection policy can't be updated and only ciphertext is returned in the response.
   Version Header	Determines the location where version header will be stored. Possible options are: — Internal: version header is prepended to the ciphertext. — External: version header is stored in a separate field. For details, click here.

5. Click Create. A message stating, Protection Policy created successfully is displayed and the newly created policy is listed on the Protection Policies page.

Important Notes

Note

• When a protection policy is created, Version 1 is assigned to that policy. The version is incremented with each updation.

• If versioning is disabled, protection policy can't be modified.

• For disabled versioning, only version "0" of a key can be used in cryptographic operations.

• The versioning type, selected while creating a protection policy can't be modified.

• The name of the protection policy can't be modified.