Skip to content

Commit 14ebf5d

Browse files
manually wrapped command with wrapping issue in PDF format
1 parent 01b2293 commit 14ebf5d

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

product_docs/docs/tde/15/secure_key/passphrase.mdx

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ description: Learn how to secure your encryption key with a passphrase.
66
You can protect the data key with a passphrase using the OpenSSL command line utility. The following is an example that sets up this protection:
77

88
```shell
9-
initdb -D datadir --data-encryption --key-wrap-command='openssl enc -e -aes-128-cbc -pbkdf2 -out "%p"' --key-unwrap-command='openssl enc -d -aes-128-cbc -pbkdf2 -in "%p"'
9+
initdb -D datadir --data-encryption \
10+
--key-wrap-command='openssl enc -e -aes-128-cbc -pbkdf2 -out "%p"' \
11+
--key-unwrap-command='openssl enc -d -aes-128-cbc -pbkdf2 -in "%p"'
1012
```
1113

1214
This example wraps the randomly generated data key (done internally by initdb) by encrypting it with the AES-128-CBC (AESKW) algorithm. The encryption uses a key derived from a passphrase with the PBKDF2 key derivation function and a randomly generated salt. The terminal prompts for the passphrase. (See the openssl-enc manual page for details about these options. Available options vary across versions.) The initdb utility replaces `%p` with the name of the file that stores the wrapped key.

0 commit comments

Comments
 (0)