Encryption Tools

Certent CDM provides encryption tools to ensure the security of your configuration files.

Encrypt and Decrypt Configuration Files

You can use the EncryptionTool.exe executable file to encrypt and decrypt the ConnectionStrings.config and Credentials.config files in CDM.

The EncryptionTool.exe executable file is in the Tools directory where you installed the server components, for example, in the C:\inetpub\wwwroot\CertentCDM-Server\Tools directory.

To encrypt, run the following command:

ConfigFileEncryptionTool.bat encrypt ../

To decrypt, run the following command:

ConfigFileEncryptionTool.bat decrypt ../

Note: "../" indicates that the Web.config file for the CDM Server is located in a folder one step above the location of ConfigFileEncryptionTool.bat.

Master and Data Encryption Keys

An encryption key is a mathematical value that allows components to verify that they are in communication with the expected server. Encryption keys are based on a public or private key pair that is created during the installation process. You can use the Certent.EncryptionTool.exe executable file to set, change, and export the master and data encryption keys for Certent CDM.

Certent.EncryptionTool.exe is also in the Tools directory where you installed the server components, for example, in C:\inetpub\wwwroot\CertentCDM-Server\Tools.

Supported Operations

You can perform the following operations with the encryption tools:

Generate Master Key (/GMK)
Generates a new master encryption key.
Set Master Key (/SMK)
Sets a user-specified master key.
Change Master Key (/CMK)
Changes the master key with a user-specified master key.
Export Master Key (/EMK)
Exports the master key from a configuration file to a user-specified file.
Generate Encryption Key (/GEK)
Generates a new data encryption key.
Set Encryption Key (/SEK)
Gets a user-specified data encryption key.
Change Encryption Key (/CEK)
Changes the data encryption key with a user-specified data encryption key.
Export Encryption Key (/EEK)
Exports the encryption key currently stored in the database to a user-specified file.

Command Structure

The following illustrates the structure of the commands for each operation, where, (/a /b denotes a grouping of two parameters to be used together, (/a | /b denotes a choice between two parameters, and [/a] denotes an optional parameter.

Generate Master Key

EncryptionTool.exe /GMK (/cfgfile:configfile | /o:outputfile)

Set Master Key

EncryptionTool.exe /SMK /newkey:thenewkey [/keyformat:format]
(/cfgfile:configfile | /o:outputfile)

Change Master Key

EncryptionTool.exe /CMK /oldkey:theoldkey /newkey:thenewkey
[/keyformat:format] (/cfgfile:configfile | /o:outputfile)
[/db:connectionString]

Export Master Key

EncryptionTool.exe /EMK /cfgfile:configfile /o:outputfile

Generate Encryption Key

EncryptionTool.exe /GEK (/cfgfile:configfile |
(/masterkey:themasterkey [/keyformat:format]))
((/db:connectionString [/em:encryptionModule] [/f]) |
/o:outputfile)

Set Encryption Key

EncryptionTool.exe /SEK /newkey:thenewkey [/keyformat:format]
(/cfgfile:configfile | /masterkey:themasterkey)
((/db:connectionString [/em:encryptionModule] [/f]) |
/o:outputfile)

Change Encryption Key

EncryptionTool.exe /CEK /oldkey:theoldkey /newkey:thenewkey
[/keyformat:format] (/cfgfile:configfile |
/masterkey:themasterkey) ((/db:connectionString
[/em:encryptionModule]) | /o:outputfile)

Export Encryption Key

EncryptionTool.exe /EEK (/cfgfile:configfile |
(/masterkey:themasterkey [/keyformat:format]))
/db:connectionString /o:outputfile

Help

EncryptionTool.exe /help

Arguments

The following explains the argument semantics.

Argument	Description
`/GMK`	Flag for the Generate Master Key operation.
`/SMK`	Flag for the Set Master Key operation.
`/CMK`	Flag for the Change Master Key operation.
`/EMK`	Flag for the Export Master Key operation.
`/GEK`	Flag for the Generate Encryption Key operation.
`/SEK`	Flag for the Set Encryption Key operation.
`/CEK`	Flag for the Change Encryption Key operation.
`/EEK`	Flag for the Export Encryption Key operation.
`/oldkey`	The old master key or encryption key.
`/newkey`	The new master key or encryption key.
`/masterkey`	The master key to use for encryption key operations.
`/keyformat`	The format of the `/oldkey`, `/newkey`, and `/masterkey` arguments. Valid values are: plain - key: plaintext base64 - key: base64 encoded string file - key: path to a key file
`/f`	Forces storing the encryption key in the database, and loses any data already encrypted.
`/em`	The path to the encryption module to be used for database encryption or re-encryption. If this argument is missing from the encryption key operation, the data in the database is not changed.
`/cfgfile`	The path to the configuration file where the master key will be saved for master key operations or load the master key from for encryption key operations.
`/db`	The connection string to the database where the encryption keys will be saved for encryption key operations, or where the encryption keys will be re-encrypted for master key operations.
`/o`	The file name (with relative or absolute path) where to save the new master or encryption key.
`/help`	Shows the help information.