Encryption Model

This section describes how PPM encrypts sensitive data.

In this topic:

Full Disk Encryption (FDE)

Full disk encryption (FDE) is supported for all system components, including database, server, repository server, and client machines. Implementation of FDE can have an impact on system performance. For details, contact the vendor providing encryption.

PPM Encryption

PPM crypto capability is used to encrypt sensitive credentials and store them encrypted in the database or configuration file. Examples of sensitive data include credentials in the database server PPM uses, credentials to the LDAP with which PPM integrates, and credentials for machines that contain user data.

PPM crypto implementation uses the following security configuration:

Symmetric block cipher, AES engine, 128 bits key size, JCE provider

Public-key cipher, ElGamal engine, 600 bits key size

It is recommended that you use strong encryption to encrypt sensitive credentials. For details, see kEncrypt.sh.

Password Encryption

User passwords are stored either in its encrypted format or hashed versions by SHA256.

By default, user passwords are encrypted. To hash user passwords, do the following:

1. Run the kConvertUserPasswords.sh script to convert existing user passwords to the hashing algorithm. For details, see kConvertUserPasswords.sh.

2. Set the USER_PASSWORD_ENCRYPTION parameter to SHA256

By default, PPM uses ELGamal to encrypt password. After admin enables FIPs, PPM uses AES.

FIPS Option	Standard (Encrypted)	Hash
FIPS Enable	AES	SHA256
FIPS Disable	ElGamal	SHA256

FAQ

Question

Does PPM transmit account passwords in an approved encrypted format?

Answer

It is strongly recommended to enable SSL on the PPM and LDAP servers to ensure secured account password transmission.

Question

Does PPM store account passwords in approved encrypted format?

Answer

Admin can choose either stand or hash mode to store user passwords.

Question

Does PPM use the Federal Information Processing Standard (FIPS) 140-2 validated cryptographic modules and random number generator to implement encryption, key exchange, digital signature, and hash functionality?

Answer

Partial.

When the administrator enable FIPS, all passwords saved in the configuration file are encrypted with a FIPS compliant AES algorithm, including database password, LDAP password. All user passwords stored in database are encrypted with a FIPS compliant AES algorithm if the administrator uses the stand password mode.

Question

What are the base product and service authentication methods provided (user name and password)?

Answer

User name and password, NTLM, LDAP authentication.

Question

Is SAML v2.0 supported for performing authentication?

Answer

No.

Question

Is Single Sign On (SSO) supported?

Answer

Yes, for SiteMinder, NTLM, and HP LWSSO.

Question

Does PPM integrate with Identity Management (via API or AD) for system and product users?

Answer

PPM integrates with SiteMinder, where a remotely authenticated user name is passed in the header. This requires a separate configuration. For details, see Configure OpenText PPM for integration with SiteMinder.