-

If the configuration encryption is disabled and you want to prevent any unencrypted configuration files to be written to any target location, cancel the download popup and enable the configuration encryption before starting an export. This is important if the target location is an SSD and secure erase is only possible for the full disk drive.

For more information, see Sign and encrypt engine in Identity Manager.

The encrypted zip archive contains descriptors.info. The file is a part of the encryption mechanism and provides useful hints on the underlying encrypted zip archive, see the example below.

The descriptor name and version for encryption and (optionally) signing in descriptors.info provides information before importing data or uploading configurations into the application. You can verify the given information against the settings in engineSignEncryptConfig.xml.

Nexus-Encrypted-Archive-Name: encrypted_config_zip.bin
Nexus-Encryption-Descriptor-Name: ConfigZipEncrypter
Nexus-Encryption-Descriptor-Version: 1
Nexus-Signature-Descriptor-Name: SignVerifyDescriptor
Nexus-Signature-Descriptor-Version: 2

The encrypted configuration zip archive has the wrapped symmetric key inside. The asymmetric key for unwrapping and decrypting must be defined in engineSignEncryptConfig.xml. The settings in engineSignEncryptConfig.xml and the key container file (for example, the .p12 file) defined in the descriptor of the XML file must be shared across instances.

Automatic decryption

Automatic sensing of necessary decryption is enabled regardless of the zipPacker.encryptZip property in system.properties when you import a configuration zip archive, for example, a configuration/translation/process/... zip archive. You can always import unencrypted configuration archives. You can import encrypted configuration archives if the settings in engineSignEncryptConfig.xml are available and correct and the property zipEncrypterDecrypter.version in system.properties matches the Nexus-Encryption-Descriptor-Version in descriptors.info of the archive.

You must also verify the settings against descriptors.info of the archive you want to import.

Manual decryption

You cannot perform manual decryption outside of Smart ID Identity Manager.

To support successful decryption of any already exported encrypted archives, do not change the settings for the existing version number.

When you import an older versioned encrypted configuration file into the system, make sure to update the XML file accordingly. 

## default version number is 1, but if it has to be increased, this is the only way
## to provide the version number to be used by the encryption of the configuration
zipEncrypterDecrypter.version=2

To remove or reduce the old descriptor settings, for example, for cleanup purposes, do the following:

1. In the Configuration File tab, delete the configuration to have a clean database.
2. Stop Tomcat.
3. Configure engineSignEncryptConfig.xml to include all known versions of the descriptors and the related keys.
   
4. Look up the Nexus-Encryption-Descriptor-Version in descriptors.info file of the archive you want to import next and configure the property zipEncrypterDecrypter.version in system.properties with that version number.
5. Start Tomcat.

6. Import one configuration file with old encryption setting that you want to renew into this test system.

7. Stop Tomcat.

8. Reconfigure the zipEncrypterDecrypter.version to match the new descriptor version setting.

9. Start Tomcat.

10. Export the newly encrypted configuration.

To continue with another archive, repeat the entire procedure.

The encryption of configuration archives in the easiest setup could use equal settings like the regular secret field encryption, for example, see the descriptors "EncryptedFields" and "ConfigZipEncrypter" below.

You must set a separate descriptor with its own version and its own key attribute that also references a new key element. For more information, see the descriptor "ConfigZipEncrypter" and key "configZipEncrypterCert" below.

<?xml version="1.0" encoding="UTF-8"?>
<engineSignEncrypt>
	<descriptors>
		<descriptor name="EncryptedFields" version="1">
			<type algorithm="AES/CBC/PKCS7Padding" size="256" result="NX02" key="encCert" asymCipher="RSA/None/OAEPWithSHA384AndMGF1Padding"/>
		</descriptor>
		<descriptor name="ConfigZipEncrypter" version="1">
			<type algorithm="AES/CBC/PKCS7Padding" size="256" result="NX02" key="configZipEncrypterCert" asymCipher="RSA/None/OAEPWithSHA384AndMGF1Padding"/>
		</descriptor>
		<descriptor name="ConfigZipSigner" version="1">
			<type algorithm="SHA-256" size="" result="" key="configZipSignerCert"/>
		</descriptor> ... </descriptors>
	<keys>
		<key name="encCert">
			<type name="pkcs12" locationValue="classpath:hybridEncKeypair.p12" pin="1234567"/>
		</key>
		<key name="configZipEncrypterCert">
			<type name="pkcs12" locationValue="classpath:hybridEncKeypair.p12" pin="1234567"/>
		</key>
		<key name="configZipSignerCert">
			<type name="pkcs12" locationValue="classpath:sign.p12" pin="1234"/>
		</key> 
...

To ensure compatibility for environments that should import an encrypted configuration archive, all environments must have the same descriptor with the same version and the same key in its setup. Make sure that the descriptor and key naming is unique across the environments exchanging the encrypted configuration.

To enable transfer of encrypted configuration archives between environments, in both directions, the setup must be adjusted. The same descriptor and key can be used in both environments,. For production usage, consider PIN encryption in the file.

The descriptor and key naming for creation of the signature should be unique to share them across the different applications or instances that should load the signed and encrypted configuration archive.