Configuring SCRYPT password encryption for IBM Verify Directory

Edit online

You can configure SCRYPT password encryption.

Before you begin

Install IBM® Verify Directory Version 11.0.1.
Install GSKit, Version 9.0.0.8 or later.

Note: Consider the following notes

If GSKit version is older than 8.0.60.4, then, a message is printed in traceibmslapd.log file that, Upgrade GSKit version to 8.0.60.4 or later to use any of SCRYPT encryption mechanism.
If ibm-slapdPwEncryption is set to SCRYPT algorithm, and GSKit version is older than, 8.0.50.88, then, server will start in configuration only mode with ERROR message in ibmslapd.log and on console that, upgrade GSKit to 8.0.60.4 or later to set SCRYPT algorithm for ibm-slapdPwEncryption.

About this task

Procedure

Create and configure a directory server instance.
Stop directory server(ibmslapd) and admin server(ibmdiradm) processes.
Enable the SCRYPT encryption option in IBM Verify Directory instance via the following configuration attributes in the "cn=Configuration" entry:
```
ibm-slapdPwEncryption: scrypt
ibm-slapdUseNonFIPSCrypt: TRUE
```
The configuration is stored in the ibmslapd.conf file of the respective server instance.
The Directory Administrator can set these values by using the standard ldap modify operation:
For example: /opt/ibm/ldap/V11.0.1/bin/idsldapmodify -h <hostname> -p <port> -D <adminDN> -w <admin_password> -i confupdate.ldif
where
the following section specifies the contents of confupdate.ldif:
```
dn: cn=Configuration
changetype: modify
replace: ibm-slapdPwEncryption
ibm-slapdPwEncryption: scrypt
-
replace: ibm-slapdUseNonFIPSCrypt
ibm-slapdUseNonFIPSCrypt: TRUE
```
Note: If, ibm-slapdUseNonFIPSCrypt is missing (default) or not set to TRUE and ibm-slapdPwEncryption is set to SCRYPT algorithm, then, the server will start in configuration only mode with the following ERROR message on the console and in the ibmslapd.log file.
ERROR: Set ibm-slapdUseNonFIPSCrypt to TRUE in cn=Configuration entry to set SCRYPT password encryption algorithm for ibm-slapdPwEncryption.
The following environment variables can be set to configure different parameters for SCRYPT algorithm. This variable is set in "cn=Front End, cn=Configuration" of ibmslapd.conf.

ibm-slapdScryptCostParameterN

This is an exponent value. Final value for CPU/Memory cost parameter will be calculated as 2^value The default value is 14.

ibm-slapdScryptBlockSizeR

The default value for Block size parameter is 8.

ibm-slapdScryptParallelizationParameterP

The default value for Parallelization parameter is 1.

ibm-slapdScryptMaxMemory

The default value for memory is 20971520.
Note: When you set these environment variable from the command line, enter in uppercase characters only. For example,
```
env ‘IBM-SLAPDSCRYPTCOSTPARAMETERN=12’
```
To set the these parameters in the cn=Front End, cn=Configuration entry of ibmslapd.conf file with ibm-slapdSetenv attribute, the Directory Administrator can set this value by using the following standard ldap modify operation:
/opt/ibm/ldap/V11.0.1/bin/idsldapmodify -h <hostname> -p <port> -D <adminDN> -w <admin_password> -i confupdate2.ldif
where contents of the confupdate2.ldif are:
```
dn: cn=Front End, cn=Configuration
changetype: modify
add: ibm-slapdSetEnv
ibm-slapdSetEnv: ibm-slapdScryptCostParameterN=12
ibm-slapdSetEnv: ibm-slapdScryptParallelizationParameterP=1
ibm-slapdSetEnv: ibm-slapdScryptBlockSizeR=8
```
The server sets a default value, if the provided value is invalid or is not in the allowed limit. The server will display a warning message on the console and in ibmslapd.log file about the use of incorrect values and the server will use the default value.
You must restart the server after this operation for the new values for the above parameters to take effect.
Start the directory server and admin server.