Use this page to configure the encryption and decryption
parameters for the signature method, digest method, and canonicalization
method.
The specifications that are listed on this page for the signature
method, digest method, and canonicalization method are located in
the World Wide Web Consortium (W3C) document entitled, XML Encryption
Syntax and Processing: W3C Recommendation 10 Dec 2002.
To view this administrative console page, complete the following
steps:
- Click Applications > Enterprise Applications > application_name and
complete one of the following steps:
- Under Related Items, click EJB modules or Web
modules > URI_file_name > Web Services: Client Security
Bindings. Under Request sender binding, click Edit. Under
Additional properties, click Encryption Information.
- Under Related Items, click EJB modules or Web
modules > URI_file_name > Web Services: Server Security
Bindings. Under Response sender binding, click Edit. Under
Additional properties, click Encryption Information.
- Select None or Dedicated encryption information.
The application server can have either one or no encryption configurations
for the request sender and the response sender bindings. If you are
not using encryption, select None. To configure encryption
for either of these two bindings, select Dedicated encryption information and
specify the configuration settings using the fields that are described
in this topic.
Specifies the name that is used to reference the key locator.
You can configure these key locator
reference options on the server level and the application level. The
configurations that are listed in the field are a combination of the
configurations on these two levels.
To configure the key locators on the server level, complete the
following steps:
- Click Servers > Application servers > server_name.
- Under Security, click Web services: Default bindings for Web
services security.
- Under Additional properties, click Key locators.
To configure the key locators on the application level, complete
the following steps:
- Click Applications > Enterprise applications > application_name.
- Under Related items, click EJB modules
> URI_name.
- Under Additional properties, you can access
the key locators for the following bindings:
- For the Request sender, click Web services: Client security
bindings. Under Request sender binding, click Edit. Under
Additional properties, click Key locators.
- For the Request receiver, click Web services: Server security
bindings. Under Request receiver binding, click Edit. Under
Additional properties, click Key locators.
- For the Response sender, click Web services: Server security
bindings. Under Response sender binding, click Edit. Under
Additional properties, click Key locators.
- For the Response receiver, click Web services: Client security
bindings. Under Response receiver binding, click Edit.
Under Additional properties, click Key locators.
Specifies the algorithm uniform resource identifier (URI)
of the key encryption method.
The following algorithms are supported:
Note: If an InvalidKeyException error occurs and you are using
the 129xxx or 256xxx encryption algorithm, the unrestricted policy
files might not exist in your configuration.
Java Cryptography Extension
By default,
the Java Cryptography Extension (JCE) is shipped with restricted or
limited strength ciphers. To use 192-bit and 256-bit Advanced Encryption
Standard (AES) encryption algorithms, you must apply unlimited jurisdiction
policy files.
Note: Before downloading these policy files, back
up the existing policy files (local_policy.jar and US_export_policy.jar in the WAS_HOME/jre/lib/security/ directory)
prior to overwriting them in case you want to restore the original
files later.
Important: Your country of origin
might have restrictions on the import, possession, use, or re-export
to another country, of encryption software. Before downloading or
using the unrestricted policy files, you must check the laws of your
country, its regulations, and its policies concerning the import,
possession, use, and re-export of encryption software, to determine
if it is permitted.
Application server platforms and
IBM Developer Kit, Java Technology Edition Version 1.4.2
![[Windows]](../../windows.gif)
For application server platforms
using IBM Developer Kit, Java Technology Edition Version 1.4.2, complete
the following steps to obtain unlimited jurisdiction policy files:
- Go to the following Web site: IBM developer kit: Security information
- Click Java 1.4.2
- Click IBM SDK Policy files.
The Unrestricted JCE Policy
files for SDK 1.4 Web site is displayed.
- Enter your user ID and password or register with IBM to download
the policy files. The policy files are downloaded onto your machine.
![[HP-UX]](../../hpux.gif)
For application server platforms using
the Sun-based Java Development Kit (JDK) Version 1.4.2, including
the Solaris environments and the HP-UX platform, complete the following
steps to obtain unlimited jurisdiction policy files:
- Go to the following Web site: http://java.sun.com/j2se/1.4.2/download.html
- Click Archive area.
- Locate the Java Cryptography Extension (JCE) Unlimited Strength
Jurisdiction Policy Files 1.4.2 information and click Download.
The jce_policy-1_4_1.zip file is downloaded onto your machine.
After completing these steps, two Java archive (JAR)
files are placed in the Java virtual machine (JVM) jre/lib/security/ directory.
Specifies the algorithm Uniform Resource Identifiers (URI)
of the data encryption method.
The following algorithms are supported:
By default, the JCE ships with restricted or limited strength ciphers.
To use 192-bit and 256- bit AES encryption algorithms, you must apply
unlimited jurisdiction policy files. For more information, see the
Key encryption algorithm field description.