Hi Team,

Can you please confirm the password encryption algorithm (MD5,SHA,AES) used to store the users password/password alias map config in appliance.

Thanks

Hello IBM Folks (Hermann??), I'd be interested in this as well.  

Many times this kind of question comes from a security audit, so if you can please provide the answer.

When you define role-based management (RBM), you define the password policy for local users. The password policy provides whether you want to use MD5 (default) or SHA-256 Crypt as the hash, where you want to use SHA-256 Crypt. Then there is encryption like all things on DataPower, but those details are proprietary.

Is that also the governing setting for protection of password map aliases?

Hi Hackerman,

I have already checked on RBM Password encryption.
Below is used, so it means all our password encryption works on sha-256 mechanism.

Password hash algorithm

Thanks