Encryption information configuration settings: Methods

Use this page to configure the encryption and decryption parameters for the signature method, digest method, and canonicalization method.

The specifications that are listed on this page for the signature method, digest method, and canonicalization method are located in the World Wide Web Consortium (W3C) document entitled, XML Encryption Syntax and Processing: W3C Recommendation 10 Dec 2002. To view this administrative console page, complete the following steps:

1. Click Applications > Enterprise Applications > application_name and complete one of the following steps:

   • Click Manage modules > URI_file_name > Web Services: Client Security Bindings. Under Request sender binding, click Edit. Under Web Service Security Properties, click Encryption Information.

   • Click Manage modules > URI_file_name > Web Services: Server Security Bindings. Under Response sender binding, click Edit. Under Web Service Security Properties, click Encryption Information.

2. Select None or Dedicated encryption information. The application server can have either one or no encryption configurations for the request sender and the response sender bindings. If you are not using encryption, select None. To configure encryption for either of these two bindings, select Dedicated encryption information and specify the configuration settings using the fields that are described in this topic.

Encryption information name

Specifies the name of the key locator configuration that retrieves the key for XML digital signature and XML encryption.

Key locator reference

Specifies the name that is used to reference the key locator.

You can configure these key locator reference options on the cell level, the server level, and the application level. The configurations that are listed in the field are a combination of the configurations on these three levels. To configure the key locators on the cell level, complete the following steps:

1. Click Security > Web services.

2. Under Additional properties, click Key locators.

To configure the key locators on the server level, complete the following steps:

1. Click Servers > Application servers > server_name.

2. Under Security, click Web services: Default bindings for Web services security.

3. Under Additional properties, click Key locators.

To configure the key locators on the application level, complete the following steps:

1. Click Applications > Enterprise applications > application_name.

2. Click Manage modules > URI_name.

3. Under Web Service Security Properties, you can access the key locators for the following bindings:

   • For the Request sender, click Web services: Client security bindings. Under Request sender binding, click Edit. Under Additional properties, click Key locators.

   • For the Request receiver, click Web services: Server security bindings. Under Request receiver binding, click Edit. Under Additional properties, click Key locators.

   • For the Response sender, click Web services: Server security bindings. Under Response sender binding, click Edit. Under Additional properties, click Key locators.

   • For the Response receiver, click Web services: Client security bindings. Under Response receiver binding, click Edit. Under Additional properties, click Key locators.

Encryption key name

Specifies the name of the encryption key that is resolved to the actual key by the specified key locator.

Data type

String

Key encryption algorithm

Specifies the algorithm uniform resource identifier (URI) of the key encryption method. The following algorithms are supported:

• http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p.

  When running with IBM Software Development Kit (SDK) V1.4, the list of supported key transport algorithms does not include this one. This algorithm appears in the list of supported key transport algorithms when running with JDK 1.5 or later. By default, the RSA-OAEP algorithm uses the SHA1 message digest algorithm to compute a message digest as part of the encryption operation. Optionally, you can use the SHA256 or SHA512 message digest algorithm by specifying a key encryption algorithm property. The property name is: com.ibm.wsspi.wssecurity.enc.rsaoaep.DigestMethod. The property value is one of the following URIs of the digest method:

  • http://www.w3.org/2001/04/xmlenc#sha256

  • http://www.w3.org/2001/04/xmlenc#sha512

  By default, the RSA-OAEP algorithm uses a null string for the optional encoding octet string for the OAEPParams. You can provide an explicit encoding octet string by specifying a key encryption algorithm property. For the property name, you can specify com.ibm.wsspi.wssecurity.enc.rsaoaep.OAEPparams. The property value is the base 64-encoded value of the octet string.

  You can set these digest method and OAEPParams properties on the generator side only. On the consumer side, these properties are read from the incoming SOAP message.

• http://www.w3.org/2001/04/xmlenc#rsa-1_5.

• http://www.w3.org/2001/04/xmlenc#kw-tripledes.

• http://www.w3.org/2001/04/xmlenc#kw-aes128.

• http://www.w3.org/2001/04/xmlenc#kw-aes192. To use the 192-bit key encryption algorithm, download the unrestricted Java Cryptography Extension (JCE) policy file.

  Note: Do not use the 192-bit key encryption algorithm if you want your configured application to be in compliance with the Basic Security Profile (BSP).

• http://www.w3.org/2001/04/xmlenc#kw-aes256. To use the 256-bit key encryption algorithm, download the unrestricted JCE policy file.

Note: If an InvalidKeyException error occurs and you are using the 129xxx or 256xxx encryption algorithm, the unrestricted policy files might not exist in your configuration.

 

Java Cryptography Extension

By default, the Java Cryptography Extension (JCE) is shipped with restricted or limited strength ciphers. To use 192-bit and 256-bit Advanced Encryption Standard (AES) encryption algorithms, apply unlimited jurisdiction policy files.

Note: Before downloading these policy files, back up the existing policy files (local_policy.jar and US_export_policy.jar in the WAS_HOME/jre/lib/security/ directory) prior to overwriting them in case you want to restore the original files later. To download the policy files, complete one of the following sets of steps:

After following either of these sets of steps, two Java archive (JAR) files are placed in the JVM jre/lib/security/ directory.

 

i5/OS operating system and IBM Software Development Kit 1.4

For the i5/OS operating system and IBM Software Development Kit V1.4, the tuning of Web services security is not required. The unrestricted jurisdiction policy files for the IBM Software Development Kit V1.4 are automatically configured when the prerequisite software is installed.

For the i5/OS operating system V5R3 and IBM Software Development Kit V1.4, the unrestricted jurisdiction policy files for the IBM Software Development Kit V1.4 are automatically configured by installing product 5722AC3, Crypto Access Provider 128-bit.

For the i5/OS operating system V5R4 and IBM Software Development Kit V1.4, the unrestricted jurisdiction policy files for the IBM Java Developer Kit 1.4 are automatically configured by installing product 5722SS1 Option 3, Extended Base Directory Support.

 

i5/OS operating system and IBM Software Development Kit 1.5

For i5/OS (both V5R3 and V5R4) and IBM Software Development Kit 1.5, the restricted JCE jurisdiction policy files are configured, by default. You can download the unrestricted JCE jurisdiction policy files from the following Web site: IBM developer kit: IBM J2SE 5 SDKs To configure the unrestricted jurisdiction policy files for the i5/OS operating system and the IBM Software Development Kit V1.5:

1. Make backup copies of these files:

   /QIBM/ProdData/Java400/jdk15/lib/security/local_policy.jar  
   /QIBM/ProdData/Java400/jdk15/lib/security/US_export_policy.jar

2. Download the unrestricted policy files from IBM developer kit: Security information to the /QIBM/ProdData/Java400/jdk15/lib/security directory.

   1. Go to this Web site: IBM developer kit: Security information

   2. Click J2SE 5.0.

   3. Scroll down and click IBM SDK Policy files. The Unrestricted JCE Policy files for the SDK Web site is displayed.

   4. Click Sign in and provide your IBM intranet ID and password.

   5. Select the appropriate unrestricted JCE policy files, and then click Continue.

   6. View the license agreement, and then click I Agree.

   7. Click Download Now.

3. Use the DSPAUT command to ensure *PUBLIC is granted*RX data authority but also ensure that no object authority is provided to both the local_policy.jar and the US_export_policy.jar files in the /QIBM/ProdData/Java400/jdk15/lib/security directory. For example:

   DSPAUT OBJ('/qibm/proddata/java400/jdk15/lib/security/local_policy.jar') 

4. Use the CHGAUT command to change authorization, if needed. For example:

   CHGAUT OBJ('/qibm/proddata/java400/jdk15/lib/security/local_policy.jar') 
   USER(*PUBLIC) DTAAUT(*RX) OBJAUT(*NONE)

Data encryption algorithm

Specifies the algorithm Uniform Resource Identifiers (URI) of the data encryption method. The following algorithms are supported:

• http://www.w3.org/2001/04/xmlenc#tripledes-cbc

• http://www.w3.org/2001/04/xmlenc#aes128-cbc

• http://www.w3.org/2001/04/xmlenc#aes192-cbc

  Do not use the 192-bit data encryption algorithm if you want your configured application to be in compliance with the Basic Security Profile (BSP).

• http://www.w3.org/2001/04/xmlenc#aes256-cbc

By default, the JCE ships with restricted or limited strength ciphers. To use 192-bit and 256- bit AES encryption algorithms, apply unlimited jurisdiction policy files. For more information, see the Key encryption algorithm field description.

Related concepts

Related tasks

Related Reference

Reference topic