About Transparent Data Encryption

Protects sensitive at-rest data using a local encryption key file or remotely stored and managed Key Management Interoperability Protocol (KMIP) encryption key.

  • Configuration file properties: Protects LDAP search password, LDAP truststore password, SSL truststore passwords.

  • System resources: Protected properties using the same key for the system.batchlog and system.paxos tables, hint files and commit logs.

  • Database tables and SSTable indexes: Protects all data in the table and on-disk SSTable indexes. Different tables can use different keys.

    SSTable data files are immutable once they have been flushed to disk and are only encrypted during the write to disk. To encrypt existing data, use the nodetool upgradesstables with the -a option to rewrite the tables to disk with encryption.

    When Transparent Data Encryption (TDE) is enabled, starting in DSE 6.9, all header data in indexes are encrypted including partition keys in SSTable indexes. This feature is designed to protect sensitive data that might be present in the primary key. Consequently, DSE cannot access SSTables that are not decryptable. When non-decryptable SSTables are present, DSE issues an error message during startup. If the error is ignored because the disk failure policy is specified as either ignore or best_effort, then DSE skips the non-decryptable SSTable and therefore ignores its content on queries without issuing a warning or error.

Data that is not encrypted

DSE does not encrypt the following:

  • Database files other than the commit log

  • SSTable data files such as offsets and tokens

  • DSEFS data files


To use the DataStax Enterprise (DSE) Transparent Data Encryption (TDE) feature, enable the Java Cryptography Extension (JCE).

Starting in JDK 8u161, JCE Unlimited is enabled by default. Refer to the Release Notes for JDK 8u161.

When using TDE secure local file system. Encryption keys are stored remotely with KMIP encryption or locally with on-server encryption.

TDE limitations and recommendations

The following utilities cannot access encrypted data, but operate on all unencrypted data.

Compression and encryption introduce performance overhead.

Data is not directly protected by TDE when you access the data using the following utilities.

Utility Reason utility is not encrypted


Uses only JMX, so data is not accessed.


Operates directly on the SSTables.


Operates directly on the SSTables.


Operates directly on the SSTables.


Operates directly on the SSTables.

Restriction: Lifecycle Manager (LCM) is not compatible when config_encryption_active is true in DSE and OpsCenter. For LCM limitations, see Encrypted DSE configuration values.

TDE options

To get the full capabilities of TDE and to ensure full algorithm support, enable JCE.

Starting in JDK 8u161, JCE Unlimited is enabled by default. Refer to the Release Notes for JDK 8u161.

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000, info@datastax.com