Summary
Periodic rekeying of encrypted data is increasingly becoming a regulatory or policy necessity, particularly in the health care and financial fields. In addition, a sometimes-overlooked problem in deploying online data encryption is the initial encryption of legacy data sets. There are two basic techniques for both initial encrypting and rekeying:
-
Copy data from its source to a destination protected by the desired encryption policy.
-
Encrypt or rekey data in place, overwriting it block by block.
As data center operations grow more complex, and as file sets grow larger, copying becomes a less viable option. Running dataxform requires cooperation between the key manager Security Administrator and administrators of protected hosts. File sets must remain offline for the duration of a dataxform run, so the expected outage window must be estimated, and everything possible done beforehand to ensure that the run will succeed. The utility includes facilities for estimating run time, and for discovering potential problems, such as linked files, prior to running the software.
