|Following the section titled "Index Privileges," add the |following section:
|The creator of a sequence automatically receives the USAGE privilege. The |USAGE privilege is needed to use NEXTVAL and PREVVAL expressions for the sequence. |To allow other users to use the NEXTVAL and PREVVAL expressions, sequence |privileges must be granted to PUBLIC. This allows all users to use the expressions |with the specified sequence.
|Following the section titled "Monitoring Access to Data Using |the Audit Facility," add the following section:
|One part of your security plan may involve encrypting your data. To do |this, you can use encryption and decryption built-in functions: ENCRYPT, |DECRYPT_BIN, DECRYPT_CHAR, and GETHINT. For more information on these |functions, including their syntax, refer to the SQL Reference section of |the Release Notes. |
|The ENCRYPT function encrypts data using a password-based encryption method. |These functions also allow you to encapsulate a password hint. The password |hint is embedded in the encrypted data. Once encrypted, the only way to decrypt |the data is by using the correct password. Developers that choose to use these |functions should plan for the management of forgotten passwords and unusable |data.
|The result of the ENCRYPT functions is the same data type as the first |argument.
|Only VARCHARs can be encrypted.
|The declared length of the result is one of the following: |
|The DECRYPT_BIN and DECRYPT_CHAR functions decrypt data using password-based |decryption.
|The result of the DECRYPT_BIN and DECRYPT_CHAR functions is the same |data type as the first argument.
|The declared length of the result is the length of the original data. |
|The GETHINT function returns an encapsulated password hint. A password |hint is a phrase that will help data owners remember passwords. For example, |the word "Ocean" can be used as a hint to remember the password "Pacific".
|The password that is used to encrypt the data is determined in one of two |ways: |
|The initial or default value for the special |register is an empty string. |
|Valid lengths for passwords are between 6 and 127 inclusive. Valid lengths |for hints are between 0 and 32 inclusive.
|When the ENCRYPTION PASSWORD special register is set from the client, the |password is encrypted at the client, sent to the database server, and then |decrypted. To ensure that the password is not left readable, it is also re-encrypted |at the database server. DECRYPT_BIN and DECRYPT_CHAR functions must |decrypt the special register before use. The value found in the ENCRYPTION |PASSWORD is also not left readable. Gateway security is not supported.