About Transparent Data Encryption

Protects sensitive at-rest data stored in configuration files and in database tables.

Protects sensitive at-rest data using a local encryption key file or remotely stored and managed KMIP encryption key.
  • Configuration file properties: Protects LDAP search password, LDAP truststore password, SSL truststore passwords.
  • System resources: Protected properties using the same key for the system.batchlog and system.paxos tables, hint files and commit logs.
  • Database tables: Protects all data in the table except for the partition key columns. Different tables can use different keys.

    SSTable data files are immutable after they have been flushed to disk. SSTable data files are encrypted only during the write to disk. To encrypt existing data, use the nodetool upgradesstables command with the -a option to rewrite the tables to disk with encryption.

Data that is not encrypted

DSE does not encrypt the following:
  • Table partition key and clustering columns
  • Database files other than the commit log and SSTable data files
  • DSEFS data files
  • Spark spill files
Warning: Do NOT store sensitive data in primary key columns. Transparent data encryption does not encrypt partition keys and clustering columns.

Requirements

To use the DataStax Enterprise Transparent Data Encryption (TDE) feature install Java Cryptography Extension, install JCE.

When using TDE secure local file system. Encryption keys are stored remotely with KMIP encryption or locally with on-server encryption.

TDE limitations and recommendations

Data is not directly protected by TDE when you access the data using the following utilities:

Utility Reason utility is not encrypted
nodetool Uses only JMX, so data is not accessed.
sstableloader Operates directly on the SSTables.
sstablescrub Operates directly on the SSTables.
sstableutil Operates directly on the SSTables.
sstableverify Operates directly on the SSTables.

Compression and encryption introduce performance overhead.

The location of the dse.yaml file depends on the type of installation:
Installer-Services /etc/dse/dse.yaml
Package installations /etc/dse/dse.yaml
Installer-No Services install_location/resources/dse/conf/dse.yaml
Tarball installations install_location/resources/dse/conf/dse.yaml