Page Comparison

...

...

Use-case:

Encryption and decryption of fields in the Identity Manager database

...

Required:

...

Always

...

Configured in

...

the following applications:

• Identity Manager Admin (previously know as PRIME Designer) David Banz can we remove PRIME from here (and everywhere in the article) or it needs to stay?

• Identity Manager Operator (previously known as PRIME Explorer) configured

Configured in these special-case tools:

• batch_secretfieldstore_change_encryption_key

  (repair tool for secret fields)

• batch_migration_smartact_to_prime

  (for migration of data from Identity Manager's/PRIME's predecessor SmartAct, it has additional requirements for decrypting secret fields and config entries from the source system) storage

Storage:

...

HSM (recommended), pkcs12,

...

Versioning:

...

Not supported, always uses version 1

...

Supported asymClipher values:

...

For HSM

• RSA/ECB/OAEPWithSHA-384AndMGF1Padding

• RSA/ECB/OAEPWithSHA-512AndMGF1Padding

  for

For PKCS#12

• RSA/None/OAEPWithSHA384AndMGF1Padding

  • RSA/None/OAEPWithSHA512AndMGF1Padding

  general

General requirements:

• placeholder

  Placeholder keys/certs forbidden for productive use

  • confidentiality of database secrets would be at risk

  • the key can only be changed with the tool batch_secretfieldstore_change_encryption_key once the first secret is stored in the database

  key

Key requirements:

...

Supported types:

• RSA 2048

• RSA 3072

• RSA 4096 (recommended)certificate

Certificate requirements:

• no

  No special requirements, as only the key-pair is used

  • may be self-signed

  • key usage is not checked (recommended for informational purposes: set dataEncipherment)

  • validity is ignored

  • certificate does not need to be trusted

ConfigZipEncrypter

...