A method, computer-readable storage medium, and computer system are provided. In an embodiment, in response to receiving a first command that specifies first data, a first cryptographic key, and a column identifier that identifies a column of rows in a database, the first data is encrypted into encrypted data using the first cryptographic key. The encrypted data is stored to a first row in the column in the database. In response to the receiving the first command, characterization data is created that specifies valid contents of the column of the rows. In response to receiving a query command that specifies a second cryptographic key and the column, the column is decrypted using the second key to create decrypted data. If the decrypted data does not satisfy the valid contents specified by the characterization data, an invalid cryptographic key action is performed.