Administration
CipherTrust Batch Data Transformation (BDT) is a command line utility that is used to transform (encrypt/tokenize) data in files and databases. It is a policy-based tool and can efficiently transform bulk data. It can also be used for rekey operations.
BDT Architecture
The BDT utility works with CipherTrust Manager (CM) for key management, and CipherTrust Vaultless Tokenization (CT-VL) for tokenization.
BDT Policy
The BDT utility's actions are based on a policy. For each action or group of actions that you want to perform with the utility, you need to define a policy.
The BDT policy defines the rules on how to perform a transformation of the data provided by the input files or databases. The policy can be configured in a file locally or on a CipherTrust Manager (CM) instance that is serving as a centralized manager for configuration, allowing for easier reuse and maintenance. Refer to Setting up BDT Policy for details.
Supported File Formats and Databases
BDT supports the following file formats:
CSV File
Fixed Length File
BDT is supported with the following databases. The table below lists the versions tested with.
| Database | Tested Version |
|---|---|
| MySQL | 8.0, 8.0.27 |
| Oracle | 12c, 19c |
| IBM DB2 | 10.5, 11.5.7 |
| SAP HANA | 2.0 |
| Microsoft SQL Server | 2017, 2019 |
Supported Transformations
BDT supports the following transformations:
Supported Encryption Algorithms
BDT supports the following encryption algorithms:
FF1
| Key Size (in bits) | 128 (default) 192 256 |
| Tweak Data | Tweak data is mandatory. The value must be 16 characters HEX encoded string. |
| Additional Notes | FF1 supports only non-versioned AES Keys. FF1 is supported when symmetric key cache is enabled. |
FF3
| Key Size (in bits) | 128 (default) 192 256 |
| Tweak Data | Tweak data is mandatory. The value must be 16 characters HEX encoded string. |
| Additional Notes | FF3 supports only non-versioned AES Keys. FF3 is supported when symmetric key cache is enabled. |
DESede
| Block Size | 8 bytes |
| Supported Modes | ECB CBC |
| Padding Schemes | PKCS5Padding NoPadding |
| IV | CBC mode requires an 8 HEX encoded characters IV. IV is not allowed in ECB mode. |
| Key Size | Supported key sizes are 168 (default) and 112 bits. Each key contains an extra 8 bits of parity. Thus, when you create a key of 112 bits, the actual key size is 128 bits; when you create a key of 168 bits, the actual key size is 192 bits. |
| Additional Notes | When using DESede with NoPadding, then data for encryption must be in multiples of 8 bytes. DESede is supported when symmetric key cache is either enabled or disabled. |
AES_CTR
| Block Size | 16 bytes |
| Padding Schemes | No padding scheme is applicable. |
| IV | CTR mode requires a 16 HEX encoded characters IV. |
| Key Size (in bits) | 128 (default) 192 256 |
| Additional Notes | AES_CTR is supported when symmetric key cache is either enabled or disabled. By default, AES_CTR is with NoPadding. |
AES_CBC_PAD
| Block Size | 16 bytes |
| Padding Schemes | No padding scheme is applicable. |
| IV | CBC mode requires a 16 HEX encoded characters IV. |
| Key Size (in bits) | 128 (default) 192 256 |
| Additional Notes | AES_CBC_PAD is supported when symmetric key cache is either enabled or disabled. By default, AES_CBC_PAD is with PKCS5Padding. |
Supported Tokenization Algorithms
Refer to CipherTrust Vaultless Tokenization (CT-VL) for details.
