topic Re: Encryption and RMS files in Operating System - OpenVMS

Encryption and RMS files

Bart Van Cauter — Wed, 31 May 2006 07:57:33 GMT

We are using an Alpha-server with Open VMS 7.3 and we have the following problem.

We store our information in RMS files and have to encrypt particular fields in those files.

This gave rise to the following questions:

1.Do you have (or know off) encryption/decryption modules on OpenVMS (SHA-1, Triple DES 128) ?

2.If we are able to encrypt/decrypt a particular field, will the SORT on sequential files still work if being used on these encrypted fields ?

3.What happens with indexed files where the key needs to be encrypted? If we want to use that key, can we than fist encrypt and then do a direct read with the encrypted value and still get the correct record back ?

Re: Encryption and RMS files

Wim Van den Wyngaert — Wed, 31 May 2006 09:05:38 GMT

Was curious and found this
http://h71000.www7.hp.com/openvms/6477pro.pdf

Wim

Re: Encryption and RMS files

Wim Van den Wyngaert — Wed, 31 May 2006 09:09:37 GMT

Start reading at 4.4

Wim

Re: Encryption and RMS files

Bart Van Cauter — Wed, 31 May 2006 09:13:45 GMT

Thanks, will surely read it!

I'm on holiday till 7/6 but when i'm back i'll dig in to it!

Re: Encryption and RMS files

Karl Rohwedder — Wed, 31 May 2006 09:48:58 GMT

Pls. note that since (I think) V8.2 the ENCRYPT no longer needs a license, but is bundled with VMS. But this (old) product only supports AES encryption. V8.3 of VMS shall contain a new version with actual encryption methods.

regards Kalle

Re: Encryption and RMS files

Hein van den Heuvel — Wed, 31 May 2006 10:32:54 GMT

>> If we are able to encrypt/decrypt a particular field, will the SORT on sequential files still work if being used on these encrypted fields ?

The native sort utility will NOT understand the underlying data sort order. It will sort the encrypted bytes, which will have a diffrent order. I don't think you can solve that with 'collating sequences.

You could write your own tool to use calleable sort and provide a comparison routine which which decode and compare.

Conceivably the sort tool would allow you to specify such compare function in a shareable library and use LIB$FIS to activate it, but best I can tell such feature does not exist.

>> 3.What happens with indexed files where the key needs to be encrypted?

Similar. You will only be able to do a 'direct match'. generic key matched ("JOHN" to find "JOHNES") and 'NEXT' operations will be meaningless.

If you go this route I would recommend to consider an artifial primary key in mostly increasing key order, like a record creation timestamp, as the primary storage tool. This will help avoid bucket splitting going crazy to deal with random inserts.

hth,
Hein.

Re: Encryption and RMS files

Bart Van Cauter — Thu, 08 Jun 2006 05:59:01 GMT

Thanks for the information!

Re: Encryption and RMS files

Aaron Sakovich — Mon, 12 Jun 2006 18:41:33 GMT

> Karl Rohwedder said:
> But this (old) product only supports AES
> encryption. V8.3 of VMS shall contain a
> new version with actual encryption methods.

Correction: the old version only supports DES encryption. The new version will support AES (the Advanced Encryption Standard). DES is a deprecated FIPS PUB standard effective May 2007.

http://csrc.nist.gov/cryptval/DESTranPlan.pdf

Just a bit of clarification,
Aaron