create Examples

Create a new encryption settings definition that will encrypt data using a 128-bit AES cipher with a key generated from an interactively provided password. It will be made the preferred settings definition for subsequent encryption operations:

encryption-settings create --cipher-algorithm AES --key-length-bits 128 \
     --prompt-for-passphrase --set-preferred

Create a new encryption settings definition that will encrypt data using a 128-bit AES cipher with the CBC cipher mode and PKCS #5 padding. It will use an encryption key generated from a password read from a file, and it will include a description:

encryption-settings create --cipher-algorithm AES \
     --cipher-transformation AES/CBC/PKCS5Padding --key-length-bits 128 \
     --passphrase-file passphrase-file.txt \
     --description "An encryption settings definition created from a known passphrase" \
     --set-preferred

create Arguments

-a {algorithm}
--cipher-algorithm {algorithm}

-t {transformation}
--cipher-transformation {transformation}

-l {bits}
--key-length-bits {bits}

--key-factory-iteration-count {count}

--prompt-for-passphrase

--passphrase-file {path}

--description {description}

-p
--set-preferred

delete Examples

Remove the encryption settings definition with the specified ID from the server:

encryption-settings delete --id DA39A3EE5E6B4B0D3255BFEF95601890AFD80709

delete Arguments

-i {id}
--id {id}

-n
--no-prompt

export Examples

Export the encryption settings definition with the given ID to output file /tmp/exported-key using the passphrase in file /tmp/export-passphrase.txt to encrypt its contents:

encryption-settings export --id DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 \
     --output-file /tmp/exported-key \
     --passphrase-file /tmp/export-passphrase.txt

Export all encryption settings definitions to output file /tmp/exported-key using the passphrase in file /tmp/exported-passphrase.txt to encrypt their contents:

encryption-settings export --output-file /tmp/exported-key \
     --passphrase-file /tmp/export-passphrase.txt

export Arguments

-i {id}
--id {id}

-o {path}
--output-file {path}

-W {path}
--passphrase-file {path}

--use-legacy-export-format

freeze Examples

Freeze the encryption settings database with a passphrase that is provided at an interactive prompt:

encryption-settings freeze

Freeze the encryption settings database with a passphrase that is read from the specified file:

encryption-settings freeze --passphrase-file /tmp/freeze-passphrase.txt

freeze Arguments

--passphrase-file {path}

get-data-encryption-restrictions Examples

Display a list of the data encryption restrictions that are currently in effect (as well as a list of those that are not in effect) for the server:

encryption-settings get-data-encryption-restrictions

import Examples

Import the encryption settings data from file /tmp/exported-key using the passphrase from file /tmp/export-passphrase.txt to decrypt its contents. It will be used to set the preferred definition for subsequent encryption operations:

encryption-settings import --input-file /tmp/exported-key \
     --passphrase-file /tmp/export-passphrase.txt --set-preferred

import Arguments

-i {path}
--input-file {path}

-W {path}
--passphrase-file {path}

-p
--set-preferred

is-frozen Examples

Indicate whether the encryption settings database is currently frozen:

encryption-settings is-frozen

list Examples

List all of the available encryption settings definitions:

encryption-settings list

list Arguments

-v
--verbose

set-data-encryption-restrictions Examples

Add a specified set of data encryption restrictions for the server:

encryption-settings set-data-encryption-restrictions \
     --add-restriction prevent-disabling-data-encryption \
     --add-restriction prevent-changing-cipher-stream-provider

Remove a data encryption restriction from the server:

encryption-settings set-data-encryption-restrictions \
     --remove-restriction prevent-changing-cipher-stream-provider

Adds all defined data encryption restrictions for the server:

encryption-settings set-data-encryption-restrictions --add-all-restrictions

set-data-encryption-restrictions Arguments

--add-restriction {name}

--remove-restriction {name}

--add-all-restrictions

--remove-all-restrictions

set-preferred Examples

Sets the encryption settings definition with the specified ID to be preferred for subsequent encryption performed by the server:

encryption-settings set-preferred --id DA39A3EE5E6B4B0D3255BFEF95601890AFD80709

set-preferred Arguments

-i {id}
--id {id}

supply-passphrase Examples

Interactively supply the passphrase needed to access the encryption settings database:

encryption-settings supply-passphrase

unfreeze Examples

Unfreeze the encryption settings database with a passphrase that is provided at an interactive prompt:

encryption-settings unfreeze

Unfreeze the encryption settings database with a passphrase that is read from the specified file:

encryption-settings unfreeze --passphrase-file /tmp/freeze-passphrase.txt

unfreeze Arguments

--passphrase-file {path}