There are only two ways of encrypting data at rest in HPCC:
- Using the ENCRYPT ECL primitive;
- Using device/filesystem encryption in the underlying Linux operating system (dm-crypt is a good option)
Both cases will end up having somewhere between 8 and 20% overhead at data retrieval time (particularly with CPU’s not supporting the AES-NI instruction set), but ENCRYPT can be limited to a certain dataset while dm-crypt is always present for the entire partition.
