ASG
IBM
Zystems
Cressida
Icon
Netflexity
 
  MQSeries.net
Search  Search       Tech Exchange      Education      Certifications      Library      Info Center      SupportPacs      LinkedIn  Search  Search                                                                   FAQ  FAQ   Usergroups  Usergroups
 
Register  ::  Log in Log in to check your private messages
 
RSS Feed - WebSphere MQ Support RSS Feed - Message Broker Support

MQSeries.net Forum IndexIBM MQ File Transfer EditionMFT encryption

Post new topicReply to topic
MFT encryption View previous topic :: View next topic
Author Message
gbaddeley
PostPosted: Mon Jan 13, 2020 8:40 pm Post subject: MFT encryption Reply with quote

Jedi

Joined: 25 Mar 2003
Posts: 2077
Location: Melbourne, Australia

I am exploring options for encryption and decryption of files that are transferred by IBM MQ MFT.

MFT has various security capabilities, as listed at https://www.ibm.com/support/knowledgecenter/SSFKSJ_9.0.0/com.ibm.wmqfte.doc/security_main.htm . This includes MQ channel TLS encryption, and MQ AMS queue encryption.

Is anyone aware of other methods that can be used to encrypt file contents in transit and at rest through MFT and MQ, so that only clear data exist in the source file and destination file? Is it practical to do this using MFT exits?
I would like to avoid using an extra step before and after the MFT transfer, such as running PGP or OpenSSH on the file contents. Ideally, the source and destinations should be able to specify keys (secret, or public / private).
_________________
Glenn
Back to top
View user's profile Send private message
gbaddeley
PostPosted: Tue Feb 11, 2020 5:04 pm Post subject: Reply with quote

Jedi

Joined: 25 Mar 2003
Posts: 2077
Location: Melbourne, Australia

No replies thus far. Does anyone have any interest that might warrant an RFE? It could be done using Java native JCA (java.security) or JCE (javax.crypto), but support for encryption / decryption / key management in MFT would not be a trivial exercise.
_________________
Glenn
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Thu Feb 13, 2020 12:14 pm Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20220
Location: LI,NY

Glenn,
I thought that using AMS would have been the way to go?

Your encryption is done in transit and at rest. And java (i.e.) the file agent supports this.
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
RogerLacroix
PostPosted: Thu Feb 13, 2020 3:19 pm Post subject: Reply with quote

Jedi Knight

Joined: 15 May 2001
Posts: 3149
Location: London, ON Canada

Hi Glenn,

UFM uses JCE (javax.crypto) for message encryption as messages are transferred between the different points. Hence, the messages are encrypted for both "in transit" and "at rest".

Regards,
Roger Lacroix
Capitalware Inc.
_________________
Capitalware: Transforming tomorrow into today.
Connected to MQ!
Twitter
Back to top
View user's profile Send private message Visit poster's website
gbaddeley
PostPosted: Mon Mar 02, 2020 2:37 pm Post subject: Reply with quote

Jedi

Joined: 25 Mar 2003
Posts: 2077
Location: Melbourne, Australia

Re: AMS, it would be a solution, but we have thousands of MFT agents spread across dozens of qmgrs, and not currently using AMS anywhere. It would be a significant undertaking to implement AMS just for this purpose.

Re: UFM, a good example of implementing encryption using JCE. Thanks for pointing that out, Roger.

It looks like we will continue using MFT and run GnuPG (aka GPG) before/after fteAnt file transfer requests.
_________________
Glenn
Back to top
View user's profile Send private message
fjb_saper
PostPosted: Tue Mar 03, 2020 5:37 am Post subject: Reply with quote

Grand High Poobah

Joined: 18 Nov 2003
Posts: 20220
Location: LI,NY

Remember as you use encryption before and after transferring the file, you also loose the capability to handle text files in different environments and change encoding (ex unix/ascii, ascii/ebcdic) etc...
_________________
MQ & Broker admin
Back to top
View user's profile Send private message Send e-mail
gbaddeley
PostPosted: Tue Mar 03, 2020 2:44 pm Post subject: Reply with quote

Jedi

Joined: 25 Mar 2003
Posts: 2077
Location: Melbourne, Australia

fjb_saper wrote:
Remember as you use encryption before and after transferring the file, you also loose the capability to handle text files in different environments and change encoding (ex unix/ascii, ascii/ebcdic) etc...

Indeed, all encrypted files must be transferred as binary, and any required encoding / EOL conversion handled by the apps at either end.
_________________
Glenn
Back to top
View user's profile Send private message
Display posts from previous:
Post new topicReply to topic Page 1 of 1

MQSeries.net Forum IndexIBM MQ File Transfer EditionMFT encryption
Jump to:



You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Protected by Anti-Spam ACP


Theme by Dustin Baccetti
Powered by phpBB 2001, 2002 phpBB Group

Copyright MQSeries.net. All rights reserved.