In SAS^® Federation Server, using the ENCRYPT data masking function with the AES algorithm might yield poor performance. For example, you might encounter this issue when you run code similar to the following:

Using ENCRYPT results in much slower performance than using other encryption methods. As a workaround, you can use another encryption method.

If you want to use AES, then you need to install the hot fix. Click the Hot Fix tab in this note to access the hot fix for this issue.

The hot fix requires that you set a configuration option:

This option maps the AES algorithm to the new AES_PBE algorithm, which performs better.

Additional ENCRYPT and DECRYPT parameters for the new method are as follows:

MAC_KEY, <MAC key string constant>
When DETERMINISTIC is true, this parameter is used to generate an AES salt and 16-byte initialization vector. The salt is generated once per invocation for all column values. The IV is generated per column value. A default is used if not specified, but that is not recommended.

SALT_LEN, <integer in [1,16]>
This parameter sets the octet length of the salt values used with the encryption. The default is 8.

There is an additional DM package configuration option, which you set as follows:

The option is the default for the MAC_KEY function argument.

Operating System and Release Information

A fix for this issue for SAS Federation Server 4.2 is available at: