Administration
CipherTrust Batch Data Transformation (BDT) is a command line utility that is used to transform (encrypt/tokenize) data in files and databases. It is a policy-based tool and can efficiently transform bulk data. It can also be used for rekey operations.
BDT Architecture
The BDT utility works with CipherTrust Manager (CM) for key management, CipherTrust Application Data Protection (CADP) for encryption, and CipherTrust Vaultless Tokenization (CT-VL) for tokenization.
BDT Policy
The BDT utility's actions are based on a policy. For each action or group of actions that you want to perform with the utility, you need to define a policy.
The BDT policy defines the rules on how to perform a transformation of the data provided by the input files or databases. The policy can be configured in a file locally or on a CipherTrust Manager (CM) instance that is serving as a centralized manager for configuration, allowing for easier reuse and maintenance. Refer to Setting up BDT Policy for details.
Supported File Formats and Databases
BDT supports the following file formats:
CSV File
Fixed Length File
BDT is supported with the following databases. The table below lists the versions tested with.
| Database | Tested Version |
|---|---|
| MySQL | 8.0.15 |
| Oracle | 12c |
| IBM DB2 | 10.5.0 |
| SAP HANA | 2.0 |
| Microsoft SQL Server | 2017 |
Supported Transformations
BDT supports the following transformations:
Supported Encryption Algorithms
BDT supports the following encryption algorithms:
FF1
| Key Size (in bits) | 128 (default) 192 256 |
| Tweak Data | Tweak data is optional but highly recommended. It uses the tweekable cipher concept to protect against statistical attacks due to potentially small input/output space. The value must be HEX encoded string. |
| Additional Notes | FF1 supports only non-versioned AES Keys. FF1 is supported when symmetric key cache is enabled. |
FPE
| Key Size (in bits) | 128 (default) 192 256 |
| Tweak Data | The value must be 16 characters HEX encoded string. |
| Additional Notes | FPE supports only non-versioned AES Keys. FPE is supported when symmetric key cache is enabled. |
DESede
| Block Size | 8 bytes |
| Supported Modes | ECB CBC |
| Padding Schemes | PKCS5Padding NoPadding |
| IV | CBC mode requires an 8 byte IV. IV is not allowed in ECB mode. |
| Key Size | Supported key sizes are 168 (default) and 112 bits. Each key contains an extra 8 bits of parity. Thus, when you create a key of 112 bits, the actual key size is 128 bits; when you create a key of 168 bits, the actual key size is 192 bits. |
| Additional Notes | When using DESede with NoPadding, then data for encryption must be in multiples of 8 bytes. DESede is supported when symmetric key cache is enabled and disabled. |
AES_CTR
| Block Size | 16 bytes |
| Padding Schemes | NoPadding - you must supply the cipher text in multiples of 16 bytes. |
| IV | CTR mode requires a 16 byte IV. |
| Key Size (in bits) | 128 (default) 192 256 |
| Additional Notes | AES_CTR is supported when symmetric key cache is enabled and disabled. |
AES_CBC_PAD
| Block Size | 16 bytes |
| IV | CBC mode requires a 16 byte IV. |
| Key Size (in bits) | 128 (default) 192 256 |
| Additional Notes | AES_CBC_PAD is supported when symmetric key cache is enabled and disabled. |
