Administer > Security Configuration > NNMi Data Encryption > Text Blocks in the Crypto Configuration Files

Text Blocks in the Crypto Configuration Files

The crypto configuration files include the following text blocks:

<allowed>

The <allowed> block defines the types of providers, algorithms, and minimum key lengths that are allowed to be used elsewhere in the crypto configuration files.

Note If you attempt to use an algorithm or key length that is not allowed, NNMi generates an encryption error.

Tip A provider is a vendor (or entity) that provides implementations of cryptographic algorithms.

The algorithms listed in the crypto configuration files are associated with the providers listed in those files.

<default>

The <default> block lists default settings used for all supported components. For example, the <default> block lists a one symmetric algorithm, one asymmetric algorithm, and one digest. If a there is a component block defined for a given component, that component uses the algorithm specified in its component block (in other words, the component block definition overrides the <default> block). Otherwise, a component will request the default algorithm (from the <default> block) for the specific type of encryption used by that component.

Each component uses only one type of encryption (symmetric, asymmetric, or digest). For example, application failover uses only symmetric encryption, so specifying an asymmetric or digest algorithm in an application failover component block would be ineffective and unnecessary.

Note A key size listed in a default block or component block must be at least the size listed in the <allowed> block (but it can be greater, if desired). For example, if the <allowed> block includes AES-128, then AES-192 is also valid. However, if the <allowed> block specifies AES-192, AES-128 is not valid.