Chapter 1: Before starting
Passphrase, encryption keys, and index files
Three different things need to be kept straight.
| Item | Purpose | Where it is managed |
|---|---|---|
| System Encryption Passphrase | Enables encryption and is part of the configuration needed to access encrypted files | System Administration, System Setup, System Parameters |
| File or FMS group Encryption Key | Selects encryption for the file or group | File Attributes or FMS Group Attributes |
| A file named PROSPECT.key | Holds the APPX indexes for PROSPECT.dat | Maintained by APPX file utilities |
The .key file is an index file. It is not a saved copy of the Encryption Key entered on the screen.
Setting a passphrase or entering a key does not rewrite an existing file. An existing file is converted by exporting its records under the old settings and importing them with Replace under the new settings. A Merge import does not perform that conversion.
File Attributes shows the configuration, rather than proving the physical file has been converted. To confirm stored encryption, use DUMP HEADER on a complete working copy as described in Analyze a working copy. The header must show ENCRYPTED after encryption, and that flag must be absent after decryption.
A nonblank file-level encryption key takes precedence over a group key. A blank file-level key allows the group key to apply. Clearing a file key will not decrypt a file that still inherits a nonblank group key.