Shape / columns · All operations

Encrypt or decrypt values

A variant of Hash or mask a column

Encrypt values under a key so they can be decrypted later, or decrypt them back.

Status

In arcform

Not built yet

arcform does not do this yet. Its place on the roadmap

What other tools call it

Meridian's classification; an independent blind rating agreed on 95.7% of 324 rows (variant, version 3).

Apache Hop (2)
Apache NiFi (4)
Apache SeaTunnel (1)
  • Encryptread 2026-09-27

    Next docs, not in 2.3.13: encrypt or decrypt named fields with AES-GCM or AES-CBC

AWS Glue (2)
  • Decryptread 2026-09-27

    Decrypt column values that were encrypted under an AWS KMS key

  • Encryptread 2026-09-27

    Encrypt column values with an AWS KMS key

Talend (2)
  • tDataDecryptread 2026-09-27

    Decrypt column values that tDataEncrypt encrypted

  • tDataEncryptread 2026-09-27

    Encrypt column values into cipher text with a password and cryptographic file or a secret key

Background

Encryption transforms plain text into cipher text that conceals its original meaning, and decryption restores the encrypted data to its original form.[1] Format-preserving encryption (FPE) gives encrypted data the same format and length as the original, so an encrypted Social Security number stays nine digits.[2]

When to use it

BigQuery's Authenticated Encryption with Associated Data (AEAD) functions let one table hold every customer's data with each customer's values encrypted under a different key.[3] Crypto-shredding is deleting an encryption key so that any data encrypted under it becomes unreadable.[3] Choose encryption over hashing when someone with the right authority will need the original value back. (Meridian's view)

Encrypting the same plaintext more than once with the same BigQuery keyset generally returns different ciphertext, because each encryption uses a different initialisation vector.[3] BigQuery's DETERMINISTIC_ENCRYPT returns the same ciphertext for the same keyset and plaintext each time it is invoked, including across queries.[4] Use deterministic encryption only when the encrypted column must be joined or grouped on, and the randomised kind everywhere else. (Meridian's view)

The raw encrypt and decrypt functions in PostgreSQL's pgcrypto use the user's key directly as the cipher key and do not check whether the encrypted data was modified.[5] Rotating keys reduces the amount of data encrypted under any one key, so a compromised key would give an attacker access to less data.[3] In BigQuery, rotating a keyset means adding a new primary key to it and then decrypting and re-encrypting all the encrypted data.[3] Data masking by encryption often needs a key to be handed to those entitled to view the data, and in practice the key may reach people without that right.[6]

The method

The Advanced Encryption Standard (AES) is a variant of the Rijndael block cipher, developed by the Belgian cryptographers Joan Daemen and Vincent Rijmen.[7] AES was announced as a standard by the US National Institute of Standards and Technology (NIST) on November 26, 2001.[7] AES has a fixed block size of 128 bits and a key size of 128, 192 or 256 bits.[7] In BigQuery's Galois/Counter Mode (GCM), each block number is combined with an initialisation vector, encrypted with AES, and combined with the plaintext by exclusive or to give the ciphertext.[3]

Format-preserving encryption (FPE) produces ciphertext in the same format as the plaintext, such as a 16-digit card number encrypted to another 16-digit number.[8]

Compared with the alternatives

FPE was motivated by fields such as card numbers in existing applications, where a block cipher's hexadecimal or Base64 output would break code expecting a 16-digit number.[8]

Sources

  1. [1]Internet Security Glossary, Version 2secondary source
  2. [2]Recommendation for Block Cipher Modes of Operation: Methods for Format-Preserving Encryptionstandard
  3. [3]AEAD encryption concepts | BigQuery | Google Cloud Documentationdocumentation
  4. [4]AEAD encryption functions | BigQuery | Google Cloud Documentationdocumentation
  5. [5]PostgreSQL: Documentation: 18: F.26. pgcrypto — cryptographic functionsdocumentation
  6. [6]Data masking - Wikipediasecondary source
  7. [7]Advanced Encryption Standard - Wikipediasecondary source
  8. [8]Format-preserving encryption - Wikipediasecondary source