| |
|
RSS Feed - WebSphere MQ Support
|
RSS Feed - Message Broker Support
|
  |
|
| MFT encryption |
« View previous topic :: View next topic » |
| Author |
Message
|
| gbaddeley |
 Posted: Mon Jan 13, 2020 8:40 pm Post subject: MFT encryption |
 |
|
Jedi Knight
Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia
|
I am exploring options for encryption and decryption of files that are transferred by IBM MQ MFT.
MFT has various security capabilities, as listed at https://www.ibm.com/support/knowledgecenter/SSFKSJ_9.0.0/com.ibm.wmqfte.doc/security_main.htm . This includes MQ channel TLS encryption, and MQ AMS queue encryption.
Is anyone aware of other methods that can be used to encrypt file contents in transit and at rest through MFT and MQ, so that only clear data exist in the source file and destination file? Is it practical to do this using MFT exits?
I would like to avoid using an extra step before and after the MFT transfer, such as running PGP or OpenSSH on the file contents. Ideally, the source and destinations should be able to specify keys (secret, or public / private).
_________________
Glenn |
|
| Back to top |
|
 |
| gbaddeley |
| Posted: Tue Feb 11, 2020 5:04 pm Post subject: |
|
|
Jedi Knight
Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia
|
No replies thus far. Does anyone have any interest that might warrant an RFE? It could be done using Java native JCA (java.security) or JCE (javax.crypto), but support for encryption / decryption / key management in MFT would not be a trivial exercise.
_________________
Glenn |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Thu Feb 13, 2020 12:14 pm Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Glenn,
I thought that using AMS would have been the way to go?
Your encryption is done in transit and at rest. And java (i.e.) the file agent supports this. 
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| RogerLacroix |
| Posted: Thu Feb 13, 2020 3:19 pm Post subject: |
|
|
Jedi Knight
Joined: 15 May 2001
Posts: 3264
Location: London, ON Canada
|
Hi Glenn,
UFM uses JCE (javax.crypto) for message encryption as messages are transferred between the different points. Hence, the messages are encrypted for both "in transit" and "at rest".
Regards,
Roger Lacroix
Capitalware Inc.
_________________
Capitalware: Transforming tomorrow into today.
Connected to MQ!
Twitter |
|
| Back to top |
|
|
| gbaddeley |
| Posted: Mon Mar 02, 2020 2:37 pm Post subject: |
|
|
Jedi Knight
Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia
|
Re: AMS, it would be a solution, but we have thousands of MFT agents spread across dozens of qmgrs, and not currently using AMS anywhere. It would be a significant undertaking to implement AMS just for this purpose.
Re: UFM, a good example of implementing encryption using JCE. Thanks for pointing that out, Roger.
It looks like we will continue using MFT and run GnuPG (aka GPG) before/after fteAnt file transfer requests.
_________________
Glenn |
|
| Back to top |
|
|
| fjb_saper |
| Posted: Tue Mar 03, 2020 5:37 am Post subject: |
|
|
Grand High Poobah
Joined: 18 Nov 2003
Posts: 20756
Location: LI,NY
|
Remember as you use encryption before and after transferring the file, you also loose the capability to handle text files in different environments and change encoding (ex unix/ascii, ascii/ebcdic) etc...
_________________
MQ & Broker admin |
|
| Back to top |
|
|
| gbaddeley |
| Posted: Tue Mar 03, 2020 2:44 pm Post subject: |
|
|
Jedi Knight
Joined: 25 Mar 2003
Posts: 2538
Location: Melbourne, Australia
|
| fjb_saper wrote: |
| Remember as you use encryption before and after transferring the file, you also loose the capability to handle text files in different environments and change encoding (ex unix/ascii, ascii/ebcdic) etc... |
Indeed, all encrypted files must be transferred as binary, and any required encoding / EOL conversion handled by the apps at either end.
_________________
Glenn |
|
| Back to top |
|
|
|
|
|
| |
|
Page 1 of 1 |
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
