Encryption details for Secret Questions - CA Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

This article provides technical details regarding the encryption methods used to protect Secret Questions, Answers, and passwords within CA Identity Manager. This information is intended for administrators verifying security compliance in their environment.

Environment

Identity Manager 14.5 & 15

Resolution

CA Identity Manager utilizes industry-standard encryption to secure sensitive user data. The specific algorithm depends on the installation mode:

• Non-FIPS Installations: Utilizes RSA Jsafe libraries for RC2 cipher encryption (SHA-1). The methods LogicalAttributeContext.decryptString() and LogicalAttributeContext.encryptString() are used to handle data.
• FIPS Mode: If installed in "FIPS mode," the application uses a FIPS-compliant AES algorithm with Cipher Block Chaining (CBC) and PKCS5 padding. Keys generated by the provided keygen tool are 256-bit. Ciphertext results are base64 encoded.

 

Configuration and Verification

Viewing Encryption Settings

1. Log in to the Identity Manager User Console.
2. Navigate to System > Logical Attributes.
3. Select Forgotten Password Handler to view the encryption settings.

Verifying Encryption

To confirm that encryption is active for your user records:

1. Access the user directory using an LDAP browser.
2. Inspect the user attribute records to ensure the data is displayed in an encrypted format.