What is the encryption method/algorithm used to encrypt traffic between Domino 8.5 servers where port encryption is utilized? The older versions used RC4 if memory serves, has this been upgraded in 8.5 to something a little less vulnerable?
Subject: Network port encryption
You can find the current (and historical) list of algorithms and key sizes used by Notes/Domino on the Notes/Domino wiki:
http://www-10.lotus.com/ldd/dominowiki.nsf/dx/supported-key-sizes-in-notesdomino
Two Notes/Domino 8.5 machines will use 128 bit RC4, with separate keys in each direction and “rolling” the stream forwards to avoid using the lower entropy earlier parts of the stream.
What are the specific concerns that you have regarding RC4? The algorithm is not exactly “vulnerable” as long as one uses it correctly… and just because some other companies have given RC4 a bad name by re-using the beginning of the stream over and over as if it were a block cipher on a file including known or predictable data in fixed locations doesn’t mean that the algorithm cannot be used correctly.
Are you looking for network port encryption using a FIPS 140-2 approved algorithm? Using a FIPS 140-2 certified cryptographic library? Is this for security concerns, for compliance reasons, or for regulatory reasons?
Thanks,
dave
Subject: Network Port Encryption
"Are you looking for network port encryption using a FIPS 140-2 approved algorithm? "
In short, yes. Thanks for the response by the way.
Most of what I’ve heard (and I’m not a crypto guy by any stretch of the imagination) has to do with the Key Scheduling Algorithm. I am only somewhat concerned given most of the traffic I have IS tunneled over VPN, but it would be a much easier discussion if I could say the port encryption was FIPS 140-2 compliant for all three reasons you list, particularly the second one.
Subject: Network Port Encryption
Okay, so it sounds like the issue is more one of explaining the math than a regulatory requirement then.
If you’re interested in helping to add triage weight to the existing feature request for port encryption using AES, please open a PMR with support and have it added to:
SPR #JSTN78RKAL: Enhancement request - stronger network encryption
Thanks,
dave