Hi everyone,

 

we are in the process of migrating from Websphere Application Server to Open Liberty.

 

For secrets that are contained in the server configuration we would like to use the convenient mechanism that Open Liberty provides with the "passwordUtilities" feature to automatically decrypt secret configuration values like "{aes}ALodREgraDRBHdCzh0ED9GCVJlD5M7EXRHJ06f5dOSY" when they are read from code.

 

Therefore we have to use the Open Liberty tool "securityUtility" in order to encrypt values with "--encoding=aes".

 

Could you please explain what "type" of AES-128 encrytion is used, i.e. is it "CBC" or "GCM"?
I could not find a hint in the documentation.

 

Thanks and best regards,

Andreas Geßner

------------------------------
Andreas Geßner
------------------------------

Hi Andreas. For AES the security utility uses the AES/CBC/PKCS5Padding cipher.

See the following source file: https://github.com/OpenLiberty/open-liberty/blob/integration/dev/com.ibm.ws.crypto.passwordutil/src/com/ibm/ws/crypto/util/PasswordCipherUtil.java#L474.

------------------------------
JESSE VAN HILL
------------------------------

Hi Jesse,

thanks for the speedy response! That is exactly the information I was looking for.

Thanks and best regards,
Andreas Geßner

------------------------------
Andreas Geßner
------------------------------

Original Message:
Sent: Wed January 18, 2023 11:11 AM
From: JESSE VAN HILL
Subject: Open Liberty - securityUtility & AES encryption details

Hi Andreas. For AES the security utility uses the AES/CBC/PKCS5Padding cipher.

See the following source file: https://github.com/OpenLiberty/open-liberty/blob/integration/dev/com.ibm.ws.crypto.passwordutil/src/com/ibm/ws/crypto/util/PasswordCipherUtil.java#L474.

------------------------------
JESSE VAN HILL
------------------------------