Advanced Encryption Standard (AES) is an encryption standard adopted by the U.S. government in 2002. Implementations of AES are available in many encryption packages. Details on AES are beyond the scope of this manual but can be found in many sources of cryptographic information.

AES supports key strengths of 128 (the server default), 192 and 256 bits. Due to import-control restrictions imposed by some countries, the default jurisdiction policy files only permit strong cryptography to be used. An unlimited strength version of these files (that is, with no restrictions on cryptographic strength) is available but is not distributed by iWay.

AES is a block cypher that encrypts and then reencrypts. Any number of iterations can be entered, and the more iterations used, the higher the cryptographic strength of the result. However, this must be balanced against the processor overhead.

The key is entered as an iFL string, and can contain up to 16, 24. or 32 characters. Each character must have a value below 256. Use of escaped literals of iRL, such as use of Unicode values or hex values enable entry of complex keys. Keys shorter than the specified lengths will be padded with binary zero.

aes('encrypt','iway software','aes')
BtJLII90UBV7wtsrpN8TDw==
_aes('decrypt','iway software','BtJLII90UBV7wtsrpN8TDw==')
aes

It may be convenient to store the key in a properties file or a special register. It is recommended that the key not be hard coded in the function call. A common way to do this is to configure a register using the iWay console, or to add to a startup script:

set register mykey _concat('secret key\x01')

The _concat function is used because the iFL optimizers would not recognize the literal 'secret key\x01' and would not convert the hexadecimal escape. Using the _concat() function causes the iFL interpreter to evaluate the literal to produce the 11 character key. This will be padded with five binary zeros by the system (assuming 128 bit keys).

iWay uses a simple cryptographic mechanism to mask passwords stored in its configuration files. The algorithm employs random seeds and salting when generating the encrypted result. The result is marked with functional braces for recognition by the internal decryption services when the value needs to be used.

iWay strongly recommends that this function not be used to protect values in business systems. Facilities to use validated PKI and session key cryptography are readily available for this purpose. The use of this function should be restricted to password masking and similar purposes.

_encr(‘iway’)

ENCR(3157318131043128321832252993249)