By Ilan Hirschowitz
With special thanks to Arno Zude for his contribution to this article.
When implementing our new Adabas Encryption Product, customers have asked us whether they should expect to see the unused Adabas database space decrease.
Background:
Adabas Encryption is based on z/OS Dataset Encryption. IBM warns that encrypting datasets before compressing them makes the compression ineffective and may use a lot of extra space (see Data set encryption - IBM Documentation). This is because encryption removes all patterns from the data that compression exploits to shorten the data.
As explained in the IBM documentation above, encrypting a sequential dataset on z/OS and then trying to compress it on the way to some other system (or tape) is not effective. If data coming from a sequential dataset is to be compressed, this should be done before it is encrypted.
How does ADABAS handle the extra space usage?
For the database container datasets (ASSO, DATA, WORK, PLOG, etc.), Adabas Encryption does not need any extra space. It does not change the sizes of the datasets and of the data they contain. Adabas compresses the payload data before it gets encrypted (by ADAIOR invoking DFSMS). Encrypting Adabas data does not change the size of the containers, and Adabas Encryption does not need those 8 bytes extra data per block.
You can see this when you compare the sizes of ADASAV SAVE outputs of a database when it is encrypted vs. not encrypted, they will be the same size.
This is also true when comparing the unused space with that of an encrypted DB.
For the sequential datasets used by Adabas (e.g., DDSAVE1-8, DDSIAUS1-2, etc.), all encryption is done only by DFSMS. Here, according to the hint in the documentation, encrypted basic format and large format sequential datasets on DASD need 8 bytes more space per block than unencrypted sequential datasets of the same type. If the data is to be compressed in addition to being encrypted, it should be compressed first. This can be done by setting the dataset up as extended format sequential dataset. DFSMS then compresses and encrypts the data that it writes out to the dataset.
Should we expect to see the Unused Database space to decrease?
No, the unused space in the database — both the free space as per the FST and the unused space within each block — remains the same with Adabas Encryption. The encryption and decryption operations are performed by ADAIOR on a per-block level. To perform the actual encryption/decryption, ADAIOR calls a DFSMS function (which invokes an ICSF function).
In conclusion, we can safely say that the sizes of the decrypted and encrypted container datasets are the same.