Resource Registry encryption overview
You can encrypt resource values that contain sensitive data, such as user credentials and database passwords. The Resource Registry uses a secure encryption key that it stores separately from the resource values. This means that you can share a resource name file but withhold the key file to protect confidential information.
The Resource Registry uses the Advanced Encryption Standard (AES) algorithm to encrypt and decrypt resource alias values by using a secure encryption key.
- Generates an encryption key.
- Assigns an ID to the key.
- Encrypts the key itself, creating the master encryption key.
- Generates a master key (.mkf) file and stores the master encryption key in it.
- Stores the key ID and .mkf file name and path in the resource name (.mrn) file.
During map execution, IBM Transformation Extender uses the master encryption key that is identified in the .mrn file to decrypt the resource value.
You can specify a custom passphrase when you generate a new .mkf file. The passphrase lets you regenerate the master encryption key if the .mkf file is damaged or lost. When you don't supply a custom passphrase, the Resource Registry randomly generates one. A randomly generated passphrase is more secure. You cannot regenerate the master encryption key with a randomly generated passphrase.