Platform Encryption for Data 360 customers can now make use of the Bring Your Own Key (BYOK) feature of Shield Platform Encryption. When you supply your own root key, you get the benefits built into Salesforce Shield Platform Encryption, plus the extra assurance that comes from exclusively managing your own key material. For Data 360, BYOK supports root keys only. Data 360 then manages all DEK creation and wrapping using the root key. To be compatible with Salesforce BYOK, use a PKCS#8 encrypted, Base64 encoded 4096 RSA key pair with appropriate headers and footers.
Where: This change applies to Lightning Experience and Salesforce Classic (not available in all environments) in Enterprise, Performance, Unlimited, and Developer editions that have Data 360 enabled.