About Transparent Data Encryption
Protects sensitive at-rest data using a local encryption key file or remotely stored and managed KMIP encryption key.
Configuration file properties: Protects LDAP search password, LDAP truststore password, SSL truststore passwords.
System resources: Protected properties using the same key for the system.batchlog and system.paxos tables, hint files and commit logs.
Database tables: Protects all data in the table except for the primary key columns. Different tables can use different keys.
SSTable data files are immutable once they have been flushed to disk and are only encrypted during the write to disk. To encrypt existing data, use the nodetool upgradesstables with the
-aoption to rewrite the tables to disk with encryption.
Primary keys are stored in plain text. Do NOT put sensitive information in partition key or clustering columns.
DSE does not encrypt the following:
Table partition key columns
Database files other than the commit log and SSTable data files
DSEFS data files
Spark spill files
The following utilities cannot access encrypted data, but will operate on all unencrypted data.
Compression and encryption introduce performance overhead.
Data is not directly protected by TDE when you access the data using the following utilities.
Restriction: Lifecycle Manager (LCM) is not compatible when
true in DSE and OpsCenter.
For LCM limitations, see Configuration encryption.
To get the full capabilities of TDE and to ensure full algorithm support, enable JCE Unlimited.