How to change cryptographic and hashing algorithms (4221298)

This solution demonstrates how to change the default cryptographic and hashing algorithms Password Manager uses to store information.

WORKAROUND:

To modify the advanced settings such as the encryption method of Password Manager:

1. On the home page of the Administration site, click General Settings|Instance Reinitialization, and expand the Advanced settings section.

2. From the Encryption algorithm drop-down list, select the encryption algorithm for encrypting users’ answers to secret questions and other security sensitive data.

3. From the Encryption key length drop-down list, select whether a 192-bit or 256-bit encryption key will be used to encrypt data.

4. In the Store user’s Questions and Answers profile in the following attribute of user’s account in Active Directory text box, enter the attribute name of user account in Active Directory in which you want to store user’s Q&A profile.

5. From the Hashing algorithm drop-down list, select the algorithm that will be used to hash users’ authentication answers.

6. Click Save.

7. In the Reinitialize Instance dialog box, enter a password for the configuration file that you should export to update users’ Q&A profiles and click Export.

8. Click Save.

After the change has been make, the profiles must by updated to allow Password Manager to read the profile information with the new encryption information.

To update users’ Q&A profiles with new instance settings:

1. Run the Migration wizard from the Password Manager CD autorun window.

2. On the Welcome page, select the Update users’ Q&A profiles with new instance settings task.

3. On the next page, upload the configuration file you exported when reinitializing the instance. Click Browse to select the file, enter the password you specified for the file, and click Next.

4. Select users whose Q&A profiles you want to update and click Next. To select groups, click Add and do the following:
•In the Add Groups dialog box, enter the group name, select the domain from the list and click Search.
•Select the required groups in the list and click Save.

5. On the next page, do one of the following and click Next:
•Click Update Q&A profiles in test mode to update profiles in test mode. Use this mode to preview the result of updating profiles.
•Click Update Q&A profiles in production mode to update profiles in production mode.

6. On the status page, click View the report for detailed information to view a detailed account of updating profiles. If you updated Q&A profiles in test mode, click Update Q&A profiles in production mode.

After you have updated the Q&A profiles with new instance settings, join other instances to this realm by exporting the configuration from the current instance and importing it to other instances. For more information on how to import and export configuration settings, see Import/Export Configuration Settings on page 106.

See Pages 115-116 of the Admin guide 5.6.x for additional information.