Informix and Security?

Hi, This may be a question that Jonathan will have to answer.... If I understand some earlier posts, Informix now requires an IBM library that has to be installed in a specific directory in order to do encryption. The good thing is that this software library can do certified FIPS-2 level security. Ok, so one has to ask.. in 11.5x, is it possible to replace the hooks to this library package with a different library that would allow for either an SOA solution (FIPS-2 / FIPS-3 Hardware Appliance) or to either a FIPS-2/FIPS3 co-processor board or to a GPU based solution? And yes, there's some method to this madness. ;-) -G

On Mon, May 18, 2009 at 08:22, Ian Michael Gumby <im_gumby@hotmail.com> wrote: > This may be a question that Jonathan will have to answer.... > > If I understand some earlier posts, Informix now requires an IBM > library that has to be installed in a specific directory in order to > do encryption. Yes. It is the IBM GSKit library, currently version 7. > The good thing is that this software library can do certified FIPS-2 > level security. Yes. > Ok, so one has to ask.. in 11.5x, is it possible to replace the hooks > to this library package with a different library that would allow for > either an SOA solution (FIPS-2 / FIPS-3 Hardware Appliance) or to > either a FIPS-2/FIPS3 co-processor board or to a GPU based solution? No; the hooks are built into IDS and can't be changed. I suppose you could put an alternative library in place that would be used instead; it would have to provide the same methods as GSKit and the same library files. What it does inside would be largely of your own devising - presumably, you aren't planning to neutralize the encryption by making the encryption methods copy input to output. However, if you do, that's your choice - don't come complaining to IBM. Googling "site:ibm.com gskit" will get you to the documentation that is available. > And yes, there's some method to this madness. ;-) With GSKit v8 (released April or May 2009), it should be possible to hook into PKCS#11-compliant API to get hardware and software support for that. IDS 11.50 will probably not upgrade to GSKit v8 during its lifetime; it is reasonable to expect that the next main release of IDS will use GSKit v8. (However, remember those disclaimer slides in IBM presentations - the ones saying "the future is unpredictable"? One of those applies here!) -- Jonathan Leffler #include <disclaimer.h> Email: jleffler@earthlink.net, jleffler@us.ibm.com Guardian of DBD::Informix v2008.0513 -- http://dbi.perl.org/ "Blessed are we who can laugh at ourselves, for we shall never cease to be amused." NB: Please do not use this email for correspondence. I don't necessarily read it every week, even. Fran Lebowitz - "If you're going to America, bring your own food." - http://www.brainyquote.com/quotes/authors/f/fran_lebowitz.html