Requirement tactical assertion which can help us to encrypt and decrypt the data

[Shalivahan Rajyaguru]

Hello Team,

Customer is using symmetrical tactical assertion in our gateway. However we are not able to set initial vector value since it is graded out.

Can you please help us on how to set this value? and let us know what is the initial IV value set for this assertion.

Version: 10.0

Thanks and regards,
Shalivahan Rajyaguru

[Ben Urbanski]

Hello Shalivahan,

Regarding the IV field of that assertion...

Encryption:

The IV field is disabled when using the encryption option. During the encryption process, a random IV is generated and added to the beginning of the returned encrypted string.

Decryption:

Leave the IV field blank, if the encrypted string already has an IV. The IV will be parsed out during the decryption process.

Provide the IV if the encrypted string will not include the IV. This field is disabled in ECB mode as ECB mode doesn't need IV.

------------------------------
Ben Urbanski
Product Manager, API Gateway
Layer7 API Management
------------------------------

[Shalivahan Rajyaguru]

Hello Ben,

Thanks for the details,

We can only see CBC mode and not ECB mode in assertion.

And IV value is graded out for CBC mode. we are looking for setting customized value to IV and not random value.

Could you please help on this !

Thanks and regards,
Shalivahan

[Ben Urbanski]

Please post a screenshot of your assertion configuration with sensitive data masked/redacted.

------------------------------
Ben Urbanski
Product Manager, API Gateway
Layer7 API Management
------------------------------

[Shalivahan Rajyaguru]

Hello Ben,

Below is the screenshot.




Thanks and regards,
Shalivahan 

[Ben Urbanski]

Thank you. Several things:

1. You appear to have an older version of the Symmetric Key Encryption assertion. Later versions should include ECB mode options. You can request a later version via support.
2. Your screenshot shows that you have Encrypt selected. Per the documentation above, we only support specifying an IV when using ECB mode when decrypting.
3. Arguably, there should be no need to specify an IV when using CBC mode when encrypting. In fact, it's a better practice to randomize the IV like we do. If you require this, it would require an enhancement to the assertion and I'd suggest you submit as an Idea in the community.

------------------------------
Ben Urbanski
Product Manager, API Gateway
Layer7 API Management
------------------------------

[Shalivahan Rajyaguru]

Hello Ben,

Thanks for the detail,

Could you please provide latest symmetric and asymmetric assertion.

Thanks and regards,
Shalivahan

[Ben Urbanski]

Sure, Shalivahan. Please open a support case to ask for the latest versions of those assertions. We request that, so we can better track who has what versions of custom assertions provided by us. Thanks!

------------------------------
Ben Urbanski
Product Manager, API Gateway
Layer7 API Management
------------------------------

[Shalivahan Rajyaguru]

Hello Ben,

Thank you !!!!