AES Modules

Properties   Config Settings  

The AES Transformer can be used to encrypt and decrypt data for regular transport.

Remarks

The AES Module contains an encoder and a decoder that receive Mule Messages from the Mule Project and perform cryptographic operations on the data. The encoder will produce an encrypted file that the decoder can then decrypt, making it possible to add secure storage to your business process.

Configuration

Since AES is a symmetric-key algorithm, the settings for the Encode operations and Decode operations are the exact same.

First set the KeySize to determine the strength of the cipher to be used. Next, set the KeyPassword to allow the module to generate the cryptographic Key and IV. Alternatively, you may set the Key and IV properties directly. Note that the same password may be used for the encoder and decoder to generate the same key and IV.

You can change how the cryptography is performed by setting the CipherMode and PaddingMode properties.

Encrypt Example

Add a File Read connector in front of the AES Encode Module and configure it to read a target file. Add the AES Encode Module behind it and configure it with a KeyPassword. That is all that is required to begin encrypting data.

The module will write the encrypted bytes to the payload of the Mule Message. You can specify a File Write connector behind AES Encode to write the encrypted bytes to disk or perform your own further processing.

Decrypt Example

Add a File Read connector in front of the AES Decode Module and configure it to read encrypted bytes. Add the AES Decode Module behind it specify the same KeyPassword. That is all that is required to begin decrypting the data.

The module will write the decrypted bytes to the payload of the Mule Message. You can specify a File Write connector behind AES Decode to write the plaintext bytes to disk or perform your own further processing.

Encoder Property List

---

The following is the full list of the properties of the encoder Module with short descriptions. Click on the links for further details.

AdditionalAuthData	Additional authentication data (AAD) used in GCM mode.
CipherMode	Controls how the transformer uses the IV to modify the cipher algorithm.
IV	The initialization vector used by the CipherMode to modify the ciphertext.
Key	The raw key used by the cipher.
KeyPassword	A password used by the transformer to generate the Key and IV .
KeySize	The size of the Key .
LogFile	The file to write logging information to at runtime.
LogMode	What information gets logged during component execution.
LogType	How information gets logged during component execution.
Other	Defines a set of configuration settings to be used by the transformer.
PaddingMode	Used by the cipher to pad the last block of input text.
RuntimeLicense	Specifies the component runtime license key.
UseHex	Whether input or output is hex encoded.

Decoder Property List

---

The following is the full list of the properties of the decoder Module with short descriptions. Click on the links for further details.

AdditionalAuthData	Additional authentication data (AAD) used in GCM mode.
CipherMode	Controls how the transformer uses the IV to modify the cipher algorithm.
IV	The initialization vector used by the CipherMode to modify the ciphertext.
Key	The raw key used by the cipher.
KeyPassword	A password used by the transformer to generate the Key and IV .
KeySize	The size of the Key .
LogFile	The file to write logging information to at runtime.
LogMode	What information gets logged during component execution.
LogType	How information gets logged during component execution.
Other	Defines a set of configuration settings to be used by the transformer.
PaddingMode	Used by the cipher to pad the last block of input text.
RuntimeLicense	Specifies the component runtime license key.
UseHex	Whether input or output is hex encoded.

Config Settings

---

The following is a list of config settings for the Module with short descriptions. Click on the links for further details.

AuthTagLength	The authentication tag length used in GCM mode.
EncryptedDataEncoding	The encoding of the encrypted input or output data.
IncludeIV	Whether to prepend the IV to the output data and read the IV from the input data.
KeyPasswordAlgorithm	The hash algorithm used to derive the Key and IV from the KeyPassword property.
KeyPasswordIterations	The number of iterations performed when using KeyPassword to derive the Key and IV.
KeyPasswordSalt	The salt value used in conjunction with the KeyPassword to derive the Key and IV.

AdditionalAuthData Property (AES Module)

Additional authentication data (AAD) used in GCM mode.

Data Type

String

Default Value

""

Remarks

This setting optionally specifies additional authentication data. The data specified must be hex encoded. This is only applicable when CipherMode is set to 6 (cmGCM). This may be set prior to encryption or decryption.

Note that AAD data is authenticated but not encrypted, so it is not included in the output message.

CipherMode Property (AES Module)

Controls how the transformer uses the IV to modify the cipher algorithm.

Data Type

Enumeration

Possible Values

MODE_CBC (1)
MODE_ECB (2)
MODE_OFB (3)
MODE_CFB (4)
MODE_CTS (5)
MODE_8OFB (6)
MODE_8CFB (7)
MODE_GCM (8)

Default Value

1

Remarks

CipherMode can be used to allow the module to use an initialization vector (IV) to manipulate the output from the cipher. This can add several degrees of security to the basic cipher algorithm.

Note: the default cipher mode is CBC as it provides a very strong layer of added security for a minimum of extra CPU power.

IV Property (AES Module)

The initialization vector used by the CipherMode to modify the ciphertext.

Data Type

String

Default Value

""

Remarks

The IV is an initialization vector used by the CipherMode to modify the ciphertext output by the module. This can add several degrees of security to the cipher.

Key Property (AES Module)

The raw key used by the cipher.

Data Type

String

Default Value

""

Remarks

The Key is a master key used to create the set of encryption and decryption keys that can be used by the cipher. Note that the same key must be used for the encoder and decoder in order to correctly decrypt the encrypted data.

KeyPassword Property (AES Module)

A password used by the transformer to generate the Key and IV .

Data Type

Password

Default Value

""

Remarks

The module can use the KeyPassword to fill in the values of Key and IV using the PKCS5 password digest algorithm. The size of the Key generated is dependent on the value of KeySize.

KeySize Property (AES Module)

The size of the Key .

Data Type

Enumeration

Possible Values

BITS_128 (128)
BITS_196 (192)
BITS_256 (256)

Default Value

256

Remarks

KeySize can be used to change the size of the key generated when the KeyPassword is set. If Key is set directly, KeySize will reflect the size of that key. The size of the key also determines the strength of the cipher algorithm:

• weak - 128 bits
• medium - 192 bits
• strong - 256 bits

Note: the default key size is 256 to ensure the maximum cipher strength.

LogFile Property (AES Module)

The file to write logging information to at runtime.

Data Type

String

Default Value

""

Remarks

To write logging information to a file instead of using the connector's logging API, set this property to a valid file on disk and set the LogType property to "File".

LogMode Property (AES Module)

What information gets logged during component execution.

Data Type

Enumeration

Possible Values

Verbose (0)
Info (1)
Warning (2)
Error (3)
Fatal (4)

Default Value

3

Remarks

This property controls what information the connector logs. The possible values have the following affect on the connector's behavior:

LogType Property (AES Module)

How information gets logged during component execution.

Data Type

Enumeration

Possible Values

None (0)
Console (1)
File (2)

Default Value

1

Remarks

This property controls where the connector will log the information. The possible values have the following affect on the connector's behavior:

Other Property (AES Module)

Defines a set of configuration settings to be used by the transformer.

Data Type

String

Default Value

""

Remarks

The module accepts one or more configuration settings. These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the module, access to these internal properties is provided through the Other property.

The Other property may be set to one or more configuration settings (name/value pairs). Set one setting per line. For example: configname1=value1 configname2=value2

PaddingMode Property (AES Module)

Used by the cipher to pad the last block of input text.

Data Type

Enumeration

Possible Values

None (1)
PKCS7 (2)
Zeros (3)
ANSIX923 (4)
ISO10126 (5)

Default Value

2

Remarks

PaddingMode is used by the cipher to pad the final input block to guarantee that it is the correct size required for the cipher's input. Each mode pads the data differently:

Note: unless the length of input is an exact multiple of the cipher's input block size (16 bytes for AES), the final block of plaintext may be lost if None is used. In order to avoid this, the default PaddingMode is PKCS7.

RuntimeLicense Property (AES Module)

Specifies the component runtime license key.

Data Type

String

Default Value

""

Remarks

You can use the RuntimeLicense property to set the runtime key for the connector license.

UseHex Property (AES Module)

Whether input or output is hex encoded.

Data Type

Boolean

Default Value

false

Remarks

This property specifies whether the encrypted data is hex encoded.

If set to True, when encrypting the connector will perform the encryption as normal and then hex encode the output.

If set to True, when decrypting the connector will expect the input to hold hex encoded data. The connector will then hex decode the data and perform decryption as normal.

Config Settings (AES Module)

The connector accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the connector, access to these internal properties is provided through the Other property.

AES Config Settings