Signing hash algorithm and encryption strength used to create the envelope

Both the signing hash algorithm and encryption strength are configurable attributes. Use application data (APPLDATA) in the RACFEVNT resource profiles to specify the signing hash algorithm that signs the PKCS #7 envelope, and the encryption strength used when encrypting the envelope. The syntax of the APPLDATA string consists of a character string indicating the signing hash algorithm, followed by a forward slash (/), followed by a string indicating the encryption strength.

Examples:

RDEFINE RACFEVNT PASSPHRASE.ENVELOPE UACC(NONE) APPLDATA('MD5/STRONG')
RALTER  RACFEVNT PASSWORD.ENVELOPE APPLDATA('MD5/STRONG')

Allowable values for the signing hash algorithm:

MD5 (default)
SHA1

Allowable values for the encryption strength:

STRONG (default)
MEDIUM
WEAK

Guideline: Use the strongest encryption possible. If you must use weaker encryption, for example, due to export regulations, then protect yourself against offline attacks by carefully controlling access to the RACF® database and any other repository where envelopes might be stored after being retrieved from RACF.

Encryption strength value	Data encryption method
STRONG	Triple DES (a 168-bit encryption key)
MEDIUM	DES (a 56-bit encryption key)
WEAK	RC2 (a 40-bit encryption key)

Note: Strong encryption might not be available at all installations based on government export regulations. See z/OS Cryptographic Services System SSL Programming for more information.

If the APPLDATA is not specified in the profile, the defaults are taken as noted above. If an empty qualifier exists in the APPLDATA, then the default value is used for that qualifier. For example, if the APPLDATA is specified as SHA1, then SHA1 is used as the signing hash algorithm, and triple DES is used as the encryption algorithm. If the APPLDATA is specified as /MEDIUM, then MD5 is used as the signing hash algorithm, and DES is used as the encryption algorithm.

If the APPLDATA is specified incorrectly, an error message is issued to the console. Thereafter, the default values are used whenever users who are eligible for enveloping change their passwords or password phrases, or whenever an application requests the retrieval of an envelope.

The APPLDATA can be changed at any time.