ENCRYPT_CIPHERS configuration parameter

Use the ENCRYPT_CIPHERS configuration parameter to define all ciphers and modes that can be used by the current database session. ENCRYPT_CIPHERS is used for Enterprise Replication and High-Availability Data Replication only.

onconfig.std value
Not set. Encryption ciphers are not used.
values
See the Usage section.
takes effect
After you edit your onconfig file and restart the database server.

Usage

The encryption cipher and mode used is randomly chosen among the ciphers common between the two servers. If a specific cipher is discovered to have a weakness, you should reset the ENCRYPT_CIPHERS configuration parameter value to eliminate that cipher by using the allbut option.

Important: Including all ciphers is more secure than including specific ciphers.
Figure 1: Syntax for the ENCRYPT_CIPHERS configuration parameter

1  ENCRYPT_CIPHERS
1 all
1  allbut : < + ,
2.1 cipher
2.1 mode >
1 + , cipher : mode
Table 1. Options for the ENCRYPT_CIPHERS configuration parameter value
Field Description
all Include all available ciphers and modes, except ECB mode, which is considered weak.

For example: ENCRYPT_CIPHERS all
allbut Include all ciphers and modes, except ECB and the ciphers and modes listed.

For example: ENCRYPT_CIPHERS allbut:<cbc,bf>

The cipher list can include unique, abbreviated entries. For example, bf can represent bf-1, bf-2, and bf-3; however, if the abbreviation is the name of an actual cipher, then only that cipher is eliminated. Therefore, des eliminates only the des cipher, but de eliminates the des, des3, and desx ciphers.

cipher The following ciphers are supported:
  • des = DES (64-bit key)
  • des3 = Triple DES
  • desx = Extended DES (128-bit key). Only supports cbc mode.
  • aes = AES 128bit key
  • aes192 = AES 192bit key
  • bf-1 = Blow Fish (64-bit key)
  • bf-2 = Blow Fish (128-bit key)
  • bf-3 = Blow Fish (192-bit key)
  • aes128 = AES 128bit key
  • aes256 = AES 256bit key

All modes are supported for all ciphers, except the desx cipher.

For an updated list of supported ciphers, see the Release Notes.

mode The following modes are supported:
  • ecb = Electronic Code Book (ECB). Only included if specified.
  • cbc = Cipher Block Chaining
  • cfb = Cipher Feedback
  • ofb = Output Feedback