--- title: Use stronger encryption algorithms description: Enable AES Key Wrap encryption with PBKDF2 and configurable hash algorithms for stronger protection of PingAM system passwords and keys component: pingam version: 7.5 page_id: pingam:installation:prepare-aeswrap canonical_url: https://docs.pingidentity.com/pingam/8.1/installation/prepare-aeswrap.html llms_txt: https://docs.pingidentity.com/pingam/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md keywords: ["Install", "Security"] page_aliases: ["install-guide:prepare-aeswrap.adoc"] superseded_by: https://docs.pingidentity.com/pingam/8.1/installation/prepare-aeswrap.html section_ids: configure-aeswrap-tomcat: Configure AES Key Wrap encryption for Tomcat configure-ssoadm-for-aes: Configure ssoadm for AES Key Wrap encryption --- # Use stronger encryption algorithms AM encrypts and decrypts system passwords and the keys used in the configuration, and by components such as agents. The default encryption algorithm is Java Cryptography Extension (JCE) [PBEWithMD5AndDES](https://docs.oracle.com/en/java/javase/11/docs/specs/security/standard-names.html#cipher-algorithm-names). If you need a more secure encryption algorithm, use the Advanced Encryption Standard (AES) Key Wrap algorithm ([RFC3394](https://www.rfc-editor.org/info/rfc3394)). AM's implementation of AES Key Wrap uses the Password-Based Key Derivation Function 2 (PBKDF2) ([RFC2898](https://www.rfc-editor.org/info/rfc2898)) with HMAC-SHA1. This lets you choose key size hash algorithms, such as SHA256, SHA384, or SHA512. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The AES Key Wrap encryption algorithm is only enabled when installing AM. There is no current upgrade path for existing installations.AES key wrap is a symmetric encryption method, which means the same key is used for encrypting and decrypting. Make sure you use the same secret (secret label: `am.global.services.session.clientbased.encryption.AES`) on all AM instances to allow any AM instance to decrypt the encrypted passwords and keys.The SOAP Security Token Service (STS) doesn't support the AES Key Wrap encryption algorithm. Don't deploy the SOAP STS in an AM instance configured to use the AES Key Wrap encryption algorithm.You must also [Configure `ssoadm` for AES Key Wrap encryption](#configure-ssoadm-for-aes). | ## Configure AES Key Wrap encryption for Tomcat 1. Edit your container startup scripts, for example `setenv.sh`, to set the following JVM system properties in Tomcat: ```none JAVA_OPTS="$JAVA_OPTS -Dcom.iplanet.security.encryptor=org.forgerock.openam.shared.security.crypto.AESWrapEncryption"(1) JAVA_OPTS="$JAVA_OPTS -Dorg.forgerock.openam.encryption.key.iterations=10000"(2) JAVA_OPTS="$JAVA_OPTS -Dorg.forgerock.openam.encryption.useextractandexpand=true"(3) JAVA_OPTS="$JAVA_OPTS -Dorg.forgerock.openam.encryption.key.size=256"(4) JAVA_OPTS="$JAVA_OPTS -Dorg.forgerock.openam.encryption.key.digest=SHA512"(5) ``` | | | | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **1** | Enables use of AES Key Wrap encryption. | | **2** | Specifies the iteration count of the encryption key. Large iteration counts, for example, of 20,000, slow down brute-force attacks when passwords are of low quality (less than 20 characters and easy to predict). AM does not have an iteration count requirement. However, it will log a warning if both of the following conditions are true:- The number of iterations is less than 10,000. - The AM encryption key is less than 20 characters long. | | **3** | Enables the algorithm introduced in AM 7.1 that reduces the performance cost of AES Key Wrap encryption even when high iteration counts are used. If this property is unset, and you configured a large iteration count, AM startup times may see a performance impact if there are many agents in your deployment. Determine the optimal iteration count based on the security and performance requirements of your deployment. | | **4** | Specifies the size of the encryption key. Configure the key size to meet the needs of your deployment. | | **5** | Specifies the digest algorithm. Possible values are `SHA1`, `SHA256`, `SHA384`, or `SHA512`. Configure the digest algorithm to meet the needs of your deployment. You cannot change these configuration parameters once AM has been installed. | ## Configure `ssoadm` for AES Key Wrap encryption After you enable AES key wrap encryption, update the `ssoadm` command for it to work with the new encryption settings. Add the following properties to the `/path/to/ssoadm/setup` and `/path/to/ssoadm/bin/ssoadm` commands: ```verbatim -Dcom.iplanet.security.encryptor=org.forgerock.openam.shared.security.crypto.AESWrapEncryption -Dorg.forgerock.openam.encryption.key.iterations=10000 -Dorg.forgerock.openam.encryption.key.size=256 -Dorg.forgerock.openam.encryption.key.digest=SHA512 ```