# mulesoft Cryptography Module - Full Documentation --- product: Cryptography Module version: 2.0 --- # Configuring JCE Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The Java Cryptography Extension (JCE) strategy lets you use Java’s powerful encryption features. You have the flexibility to encrypt an entire message or just specific parts of it using either of these two methods: - Password-based encryption (PBE) This method enables you to encrypt and sign content by simply providing an encryption password. - Key-based encryption (KBE) Similar to PGP and XML encryption, this method enables you to configure a symmetric or asymmetric key to perform encryption and signing operations. Use the Cryptography Module JCE operations to configure these methods. > [!NOTE] If you’re upgrading to Cryptography Module 2.0, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-upgrade). ## Before You Begin You are familiar with PBE and KBE encryption, concepts of public and private keys, and asymmetric cryptography. ## Configure PBE Encryption This method takes your password and runs it through a hash function to create a symmetric encryption key. This generated key works with standard encryption algorithms. Because PBE only needs a password, you don’t need a separate Global Configuration Element for JCE PBE operations. ### Configure JCE PBE Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a **Cryptography Module** JCE PBE operation to the canvas flow. ![A palette menu for adding password-based encryption modules in a cryptographic flow](/mulesoft/current/en-us/cryptography-module/2.0/_images/crypto-jce-password.png) 2. In the operation configuration window, set the **Algorithm**, **Password** **Password salt** and **Iteration count** properties: +git s image::crypto-jce-setting.png\["Configuration settings for JCE encrypt PBE with algorithm, password, password salt, iteration options"\] ### XML Examples These are XML examples for each of the JCE PBE operations: - **Jce encryption pbe** ```xml ``` If you don’t specify an algorithm, the module uses `PBEWithHmacSHA256AndAES_128` . - **Jce decrypt pbe** ```xml ``` - **Jce sign pbe** ```xml ``` If you don’t specify an algorithm, the module uses `PBEWithHmacSHA256`. - **Jce validate pbe** ```xml ``` The `expected` parameter defines the signature used to validate the message. ## Configure KBE Encryption Configure a symmetric or asymmetric key to perform encryption and signing operations. ### Configure JCE KBE Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module JCE KBE operation to the canvas flow. ![A crypto-examples project with components for encryption and decryption](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-jce-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Keystore**, **Type** (JKS, JCEKS, PKCS12), and **Password** parameters. You can also add symmetric or asymmetric key information to use in sign operations: ![Global configuration properties for Crypto JCE with keystore details](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-jce-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration panel for JCE encryption showing settings for content, algorithm, and key selection](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-jce-config.png) 4. Select the algorithm to use during the operation. ### XML Examples These XML examples show a JCE configuration that defines symmetric and asymmetric keys and different operations using these keys. - Configuration In this example, the JCE configuration contains a keystore with different types of keys: ```xml ``` - Asymmetric Encryption In this example, the operations **Jce encrypt** and **Jce decrypt** use the asymmetric keys defined in the previous configuration. Encrypting a Message ```xml ``` Decrypting a Message ```xml ``` - Symmetric Encryption In this example, the operations **Jce encrypt** and **Jce decrypt** use the symmetric keys defined in the previous configuration. Encrypting a Message ```xml ``` Decrypting a Message ```xml ``` - Signature and Validation In this example, the **Jce sign** and **Jce validate** operations use a key defined in the previous configuration: Signing a Message ```xml ``` Validating a Signature ```xml ``` The `expected` parameter defines the signature used to validate the message. ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-examples) - [Cryptography Module Reference 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference) --- product: Cryptography Module version: 2.1 --- # Configuring JCE Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The Java Cryptography Extension (JCE) strategy lets you use Java’s powerful encryption features. You have the flexibility to encrypt an entire message or just specific parts of it using either of these two methods: - Password-based encryption (PBE) This method enables you to encrypt and sign content by simply providing an encryption password. - Key-based encryption (KBE) Similar to PGP and XML encryption, this method enables you to configure a symmetric or asymmetric key to perform encryption and signing operations. Use the Cryptography Module JCE operations to configure these methods. > [!NOTE] If you’re upgrading to Cryptography Module 2.1, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.x](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-upgrade). ## Before You Begin You are familiar with PBE and KBE encryption, concepts of public and private keys, and asymmetric cryptography. ## Configure PBE Encryption This method takes your password and runs it through a hash function to create a symmetric encryption key. This generated key works with standard encryption algorithms. Because PBE only needs a password, you don’t need a separate Global Configuration Element for JCE PBE operations. ### Configure JCE PBE Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a **Cryptography Module** JCE PBE operation to the canvas flow. ![A palette menu for adding password-based encryption modules in a cryptographic flow](/mulesoft/current/en-us/cryptography-module/2.1/_images/crypto-jce-password.png) 2. In the operation configuration window, set the **Algorithm**, **Password** **Password salt** and **Iteration count** properties: +git s image::crypto-jce-setting.png\["Configuration settings for JCE encrypt PBE with algorithm, password, password salt, iteration options"\] ### XML Examples These are XML examples for each of the JCE PBE operations: - **Jce encryption pbe** ```xml ``` If you don’t specify an algorithm, the module uses `PBEWithHmacSHA256AndAES_128` . - **Jce decrypt pbe** ```xml ``` - **Jce sign pbe** ```xml ``` If you don’t specify an algorithm, the module uses `PBEWithHmacSHA256`. - **Jce validate pbe** ```xml ``` The `expected` parameter defines the signature used to validate the message. ## Configure KBE Encryption Configure a symmetric or asymmetric key to perform encryption and signing operations. ### Configure JCE KBE Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module JCE KBE operation to the canvas flow. ![A crypto-examples project with components for encryption and decryption](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-jce-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Keystore**, **Type** (JKS, JCEKS, PKCS12), and **Password** parameters. You can also add symmetric or asymmetric key information to use in sign operations: ![Global configuration properties for Crypto JCE with keystore details](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-jce-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration panel for JCE encryption showing settings for content, algorithm, and key selection](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-jce-config.png) 4. Select the algorithm to use during the operation. ### XML Examples These XML examples show a JCE configuration that defines symmetric and asymmetric keys and different operations using these keys. - Configuration In this example, the JCE configuration contains a keystore with different types of keys: ```xml ``` - Asymmetric Encryption In this example, the operations **Jce encrypt** and **Jce decrypt** use the asymmetric keys defined in the previous configuration. Encrypting a Message ```xml ``` Decrypting a Message ```xml ``` - Symmetric Encryption In this example, the operations **Jce encrypt** and **Jce decrypt** use the symmetric keys defined in the previous configuration. Encrypting a Message ```xml ``` Decrypting a Message ```xml ``` - Signature and Validation In this example, the **Jce sign** and **Jce validate** operations use a key defined in the previous configuration: Signing a Message ```xml ``` Validating a Signature ```xml ``` The `expected` parameter defines the signature used to validate the message. ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-examples) - [Cryptography Module Reference 2.1](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Configuring JCE Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt The Java Cryptography Extension (JCE) strategy lets you use Java’s powerful encryption features. You have the flexibility to encrypt an entire message or just specific parts of it using either of these two methods: - Password-based encryption (PBE) This method enables you to encrypt and sign content by simply providing an encryption password. - Key-based encryption (KBE) Similar to PGP and XML encryption, this method enables you to configure a symmetric or asymmetric key to perform encryption and signing operations. Use the Cryptography Module JCE operations to configure these methods. > [!NOTE] If you’re upgrading to Cryptography Module 2.1, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.x](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-upgrade). ## Before You Begin You are familiar with PBE and KBE encryption, concepts of public and private keys, and asymmetric cryptography. ## Configure PBE Encryption This method takes your password and runs it through a hash function to create a symmetric encryption key. This generated key works with standard encryption algorithms. Because PBE only needs a password, you don’t need a separate Global Configuration Element for JCE PBE operations. ### Configure JCE PBE Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a **Cryptography Module** JCE PBE operation to the canvas flow. ![A palette menu for adding password-based encryption modules in a cryptographic flow](/mulesoft/current/en-us/cryptography-module/latest/_images/crypto-jce-password.png) 2. In the operation configuration window, set the **Algorithm**, **Password** **Password salt** and **Iteration count** properties: +git s image::crypto-jce-setting.png\["Configuration settings for JCE encrypt PBE with algorithm, password, password salt, iteration options"\] ### XML Examples These are XML examples for each of the JCE PBE operations: - **Jce encryption pbe** ```xml ``` If you don’t specify an algorithm, the module uses `PBEWithHmacSHA256AndAES_128` . - **Jce decrypt pbe** ```xml ``` - **Jce sign pbe** ```xml ``` If you don’t specify an algorithm, the module uses `PBEWithHmacSHA256`. - **Jce validate pbe** ```xml ``` The `expected` parameter defines the signature used to validate the message. ## Configure KBE Encryption Configure a symmetric or asymmetric key to perform encryption and signing operations. ### Configure JCE KBE Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module JCE KBE operation to the canvas flow. ![A crypto-examples project with components for encryption and decryption](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-jce-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Keystore**, **Type** (JKS, JCEKS, PKCS12), and **Password** parameters. You can also add symmetric or asymmetric key information to use in sign operations: ![Global configuration properties for Crypto JCE with keystore details](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-jce-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration panel for JCE encryption showing settings for content, algorithm, and key selection](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-jce-config.png) 4. Select the algorithm to use during the operation. ### XML Examples These XML examples show a JCE configuration that defines symmetric and asymmetric keys and different operations using these keys. - Configuration In this example, the JCE configuration contains a keystore with different types of keys: ```xml ``` - Asymmetric Encryption In this example, the operations **Jce encrypt** and **Jce decrypt** use the asymmetric keys defined in the previous configuration. Encrypting a Message ```xml ``` Decrypting a Message ```xml ``` - Symmetric Encryption In this example, the operations **Jce encrypt** and **Jce decrypt** use the symmetric keys defined in the previous configuration. Encrypting a Message ```xml ``` Decrypting a Message ```xml ``` - Signature and Validation In this example, the **Jce sign** and **Jce validate** operations use a key defined in the previous configuration: Signing a Message ```xml ``` Validating a Signature ```xml ``` The `expected` parameter defines the signature used to validate the message. ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-examples) - [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference) --- product: Cryptography Module version: 2.0 --- # Configuring PGP Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Mule runtine engine (Mule) can encrypt entire messages or just parts of them using Pretty Good Privacy (PGP). PGP secures messages by combining data compression and encryption. The compression helps reduce the message size, which can speed up transmission within your Mule app. PGP encryption is more resource-intensive than JCE or XML encryption due to its increased complexity. There are two main PGP scenarios: - Encryption Encrypt an outgoing message in your Mule app using another party’s public key. - Decryption Decrypt an incoming message in your Mule app using your own private key. Use the Cryptography Module PGP operations to configure these scenarios. > [!NOTE] If you’re upgrading to Cryptography Module 2.0, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-upgrade). ## Before You Begin You are familiar with PGP encryption, concepts of public and private keys, and asymmetric cryptography. ## Configure PGP Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module PGP operation to the canvas flow. ![A palette menu for adding PGP encryption and decryption modules](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-pgp-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Public keyring** and **Private keyring** files. You can also add asymmetric key information to be used in the sign operations: ![Global element properties for Crypto PGP with keyring details](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-pgp-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration settings for PGP encrypt with algorithm and key selection](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-pgp-config.png) 4. Select the algorithm to use during the operation. ## Work with Subkeys According to the RFC-4880 standard, a PGP key can contain multiple subkeys. When you’re working with these subkeys, use the fingerprint attribute within the `` XML element to specify which subkey you want to use. For instance, if you have separate subkeys for signing and encryption, and they use different algorithms, for example, DSA for signing and ElGamal for encryption, reference the correct subkey’s fingerprint for each operation. Therefore, use the ElGamal fingerprint to encrypt your messages and the DSA fingerprint to sign them. ## Encrypt Messages with Public Keys When encrypting messages with PGP, you (the sender) must encrypt the content using the receiver’s public key. Therefore, to encrypt messages in your Mule app using someone else’s public key, add their public key to your keyring. When you configure a new PGP operation in your Mule app, provide your keyring file. The encryption module then uses this file to retrieve the necessary public key for encryption. Follow these steps: 1. Use a tool like GPG Suite to import the other party’s public key. 2. With the same tool, export the public key, making sure to select binary as the output format. This creates a keyring file with a `.gpg` extension. 3. Place the `.gpg` keyring file in a location where your Mule app can access it during runtime. Example: PGP Configuration ```xml ``` - Use the **Pgp encrypt** operation to returns an ASCII-armored encrypted payload, which is suitable for sending over plain-text channels: ```xml ``` - Use the **Pgp encrypt binary** operation to return a binary output instead: ```xml ``` Producing a binary output is faster than using ASCII-armored. However, the output is not standard and might not be ideal to send to other systems for decryption. - Use the **Pgp binary to armored** operation to send a payload with binary output to another system, and transform it to ASCII-armored: ```xml ``` This operation has a single input parameter, the message payload to transform. ## Encrypt and Sign Besides just encrypting, you can also encrypt and sign a message in one atomic operation. This returns a message in ASCII-armored format, similar to a purely encrypted one, but with an added signature inside the encrypted content. This signature acts as an integrity check, verifying the original message hasn’t been tampered with. To encrypt and sign, the private key of the signer (typically the sender) must be present in the public keyring. This process always produces an ASCII-armored output. Using the **Pgp encrypt and sign** operation: ```xml ``` ## Decrypt For PGP decryption, the message receiver must use their private key to decrypt content that was encrypted with a public key. This means the receiver needs to share their public key with anyone who will be sending them encrypted messages. Example: PGP Configuration ```xml ``` In the previous example, notice that you must provide at least three parameters to be able to use the private key ring in the decrypt operation: - Key ID (`keyId`): the internal ID that allows you to reference this key from an operation. - Key Fingerprint (`fingerprint`): The last 16 characters of your key fingerprint, which can be obtained from your external GPG tool, such as GPG Keychain. - Passphrase (`passphrase`): The passphrase of the private key. Using the **Pgp decrypt** operation ```xml ``` ## Sign Sign a message using a configured private key. Example: PGP Configuration ```xml ``` Using the **Pgp sign** operation: ```xml ``` ## Validate a Signature Validate the signature of a message using the signer’s public key. Example: PGP Configuration ```xml ``` Using the **Pgp validate** operation: ```xml ``` ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-examples) - [Cryptography Module Reference 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference) --- product: Cryptography Module version: 2.1 --- # Configuring PGP Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Mule runtime engine (Mule) can encrypt entire messages or just parts of them using Pretty Good Privacy (PGP). PGP secures messages by combining data compression and encryption. The compression helps reduce the message size, which can speed up transmission within your Mule app. PGP encryption is more resource-intensive than JCE or XML encryption due to its increased complexity. There are two main PGP scenarios: - Encryption Encrypt an outgoing message in your Mule app using another party’s public key. - Decryption Decrypt an incoming message in your Mule app using your own private key. Use the Cryptography Module PGP operations to configure these scenarios. > [!NOTE] If you’re upgrading to Cryptography Module 2.1, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.x](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-upgrade). > [!NOTE] This guide covers the main PGP operations and common use cases. For a complete list of all > available parameters and their default values, refer to > [Cryptography Module Reference 2.1](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference). ## Before You Begin You are familiar with PGP encryption, concepts of public and private keys, and asymmetric cryptography. ## FIPS Compliance Considerations > [!IMPORTANT] PGP Encrypt operations are not supported in FIPS environments, including MuleSoft > Government Cloud. > > The OpenPGP standard (RFC 4880) mandates the use of RSAES-PKCS1-v1\_5 for encrypting the session > key, which is blocked in FIPS approved mode. This limitation exists regardless of the symmetric > encryption algorithm chosen. > > Supported PGP operations in FIPS: > > - PGP Decrypt (for legacy data) > > - PGP Sign > > - PGP Validate > > For complete FIPS migration details, refer to > [cryptography-module-upgrade.adoc#scope-and-limitations-fips](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-upgrade#scope-and-limitations-fips). ## Configure PGP Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module PGP operation to the canvas flow. ![A palette menu for adding PGP encryption and decryption modules](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-pgp-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Public keyring** and **Private keyring** files. You can also add asymmetric key information to be used in the sign operations: ![Global element properties for Crypto PGP with keyring details](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-pgp-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration settings for PGP encrypt with algorithm and key selection](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-pgp-config.png) 4. Select the algorithm to use during the operation. ## Work with Subkeys According to the RFC-4880 standard, a PGP key can contain multiple subkeys. When you’re working with these subkeys, use the fingerprint attribute within the `` XML element to specify which subkey you want to use. For instance, if you have separate subkeys for signing and encryption, and they use different algorithms, for example, DSA for signing and ElGamal for encryption, reference the correct subkey’s fingerprint for each operation. Therefore, use the ElGamal fingerprint to encrypt your messages and the DSA fingerprint to sign them. ## Encrypt Messages with Public Keys When encrypting messages with PGP, you (the sender) must encrypt the content using the receiver’s public key. Therefore, to encrypt messages in your Mule app using someone else’s public key, add their public key to your keyring. When you configure a new PGP operation in your Mule app, provide your keyring file. The encryption module then uses this file to retrieve the necessary public key for encryption. Follow these steps: 1. Use a tool like GPG Suite to import the other party’s public key. 2. With the same tool, export the public key, making sure to select binary as the output format. This creates a keyring file with a `.gpg` extension. 3. Place the `.gpg` keyring file in a location where your Mule app can access it during runtime. Example: PGP Configuration ```xml ``` - Use the **Pgp encrypt** operation to returns an ASCII-armored encrypted payload, which is suitable for sending over plain-text channels: ```xml ``` Use the `disableMDC` parameter to disable modification detection code if needed for compatibility with legacy systems. For all available parameters, refer to [cryptography-module-reference.adoc#PgpEncrypt](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference#PgpEncrypt). - Use the **Pgp encrypt binary** operation to return a binary output instead: ```xml ``` Producing a binary output is faster than using ASCII-armored. However, the output is not standard and might not be ideal to send to other systems for decryption. > [!NOTE] The `disableMDC` parameter is also available for this operation. For all available > parameters, refer to > [cryptography-module-reference.adoc#PgpEncryptBinary](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference#PgpEncryptBinary). - Use the **Pgp binary to armored** operation to send a payload with binary output to another system, and transform it to ASCII-armored: ```xml ``` This operation has a single input parameter, the message payload to transform. ## Encrypt and Sign Besides just encrypting, you can also encrypt and sign a message in one atomic operation. This returns a message in ASCII-armored format, similar to a purely encrypted one, but with an added signature inside the encrypted content. This signature acts as an integrity check, verifying the original message hasn’t been tampered with. To encrypt and sign, the private key of the signer (typically the sender) must be present in the private keyring. This process always produces an ASCII-armored output. Using the **Pgp encrypt and sign** operation: ```xml ``` ## Decrypt For PGP decryption, the message receiver must use their private key to decrypt content that was encrypted with a public key. This means the receiver needs to share their public key with anyone who will be sending them encrypted messages. Example: PGP Configuration ```xml ``` In the previous example, notice that you must provide at least three parameters to be able to use the private key ring in the decrypt operation: - Key ID (`keyId`): the internal ID that allows you to reference this key from an operation. - Key Fingerprint (`fingerprint`): The last 16 characters of your key fingerprint, which can be obtained from your external GPG tool, such as GPG Keychain. - Passphrase (`passphrase`): The passphrase of the private key. Using the **Pgp decrypt** operation ```xml ``` > [!NOTE] Use the `validateIfSignatureFound` parameter to automatically validate embedded signatures > during decryption. For all available parameters, refer to > [cryptography-module-reference.adoc#PgpDecrypt](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference#PgpDecrypt). ## Sign Sign a message using a configured private key. Example: PGP Configuration ```xml ``` Using the **Pgp sign** operation: ```xml ``` ## Validate a Signature Validate the signature of a message using the signer’s public key. Example: PGP Configuration ```xml ``` Using the **Pgp validate** operation: ```xml ``` ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-examples) - [Cryptography Module Reference 2.1](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Configuring PGP Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Mule runtime engine (Mule) can encrypt entire messages or just parts of them using Pretty Good Privacy (PGP). PGP secures messages by combining data compression and encryption. The compression helps reduce the message size, which can speed up transmission within your Mule app. PGP encryption is more resource-intensive than JCE or XML encryption due to its increased complexity. There are two main PGP scenarios: - Encryption Encrypt an outgoing message in your Mule app using another party’s public key. - Decryption Decrypt an incoming message in your Mule app using your own private key. Use the Cryptography Module PGP operations to configure these scenarios. > [!NOTE] If you’re upgrading to Cryptography Module 2.1, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.x](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-upgrade). > [!NOTE] This guide covers the main PGP operations and common use cases. For a complete list of all > available parameters and their default values, refer to > [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference). ## Before You Begin You are familiar with PGP encryption, concepts of public and private keys, and asymmetric cryptography. ## FIPS Compliance Considerations > [!IMPORTANT] PGP Encrypt operations are not supported in FIPS environments, including MuleSoft > Government Cloud. > > The OpenPGP standard (RFC 4880) mandates the use of RSAES-PKCS1-v1\_5 for encrypting the session > key, which is blocked in FIPS approved mode. This limitation exists regardless of the symmetric > encryption algorithm chosen. > > Supported PGP operations in FIPS: > > - PGP Decrypt (for legacy data) > > - PGP Sign > > - PGP Validate > > For complete FIPS migration details, refer to > [cryptography-module-upgrade.adoc#scope-and-limitations-fips](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-upgrade#scope-and-limitations-fips). ## Configure PGP Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module PGP operation to the canvas flow. ![A palette menu for adding PGP encryption and decryption modules](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-pgp-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Public keyring** and **Private keyring** files. You can also add asymmetric key information to be used in the sign operations: ![Global element properties for Crypto PGP with keyring details](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-pgp-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration settings for PGP encrypt with algorithm and key selection](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-pgp-config.png) 4. Select the algorithm to use during the operation. ## Work with Subkeys According to the RFC-4880 standard, a PGP key can contain multiple subkeys. When you’re working with these subkeys, use the fingerprint attribute within the `` XML element to specify which subkey you want to use. For instance, if you have separate subkeys for signing and encryption, and they use different algorithms, for example, DSA for signing and ElGamal for encryption, reference the correct subkey’s fingerprint for each operation. Therefore, use the ElGamal fingerprint to encrypt your messages and the DSA fingerprint to sign them. ## Encrypt Messages with Public Keys When encrypting messages with PGP, you (the sender) must encrypt the content using the receiver’s public key. Therefore, to encrypt messages in your Mule app using someone else’s public key, add their public key to your keyring. When you configure a new PGP operation in your Mule app, provide your keyring file. The encryption module then uses this file to retrieve the necessary public key for encryption. Follow these steps: 1. Use a tool like GPG Suite to import the other party’s public key. 2. With the same tool, export the public key, making sure to select binary as the output format. This creates a keyring file with a `.gpg` extension. 3. Place the `.gpg` keyring file in a location where your Mule app can access it during runtime. Example: PGP Configuration ```xml ``` - Use the **Pgp encrypt** operation to returns an ASCII-armored encrypted payload, which is suitable for sending over plain-text channels: ```xml ``` Use the `disableMDC` parameter to disable modification detection code if needed for compatibility with legacy systems. For all available parameters, refer to [cryptography-module-reference.adoc#PgpEncrypt](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference#PgpEncrypt). - Use the **Pgp encrypt binary** operation to return a binary output instead: ```xml ``` Producing a binary output is faster than using ASCII-armored. However, the output is not standard and might not be ideal to send to other systems for decryption. > [!NOTE] The `disableMDC` parameter is also available for this operation. For all available > parameters, refer to > [cryptography-module-reference.adoc#PgpEncryptBinary](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference#PgpEncryptBinary). - Use the **Pgp binary to armored** operation to send a payload with binary output to another system, and transform it to ASCII-armored: ```xml ``` This operation has a single input parameter, the message payload to transform. ## Encrypt and Sign Besides just encrypting, you can also encrypt and sign a message in one atomic operation. This returns a message in ASCII-armored format, similar to a purely encrypted one, but with an added signature inside the encrypted content. This signature acts as an integrity check, verifying the original message hasn’t been tampered with. To encrypt and sign, the private key of the signer (typically the sender) must be present in the private keyring. This process always produces an ASCII-armored output. Using the **Pgp encrypt and sign** operation: ```xml ``` ## Decrypt For PGP decryption, the message receiver must use their private key to decrypt content that was encrypted with a public key. This means the receiver needs to share their public key with anyone who will be sending them encrypted messages. Example: PGP Configuration ```xml ``` In the previous example, notice that you must provide at least three parameters to be able to use the private key ring in the decrypt operation: - Key ID (`keyId`): the internal ID that allows you to reference this key from an operation. - Key Fingerprint (`fingerprint`): The last 16 characters of your key fingerprint, which can be obtained from your external GPG tool, such as GPG Keychain. - Passphrase (`passphrase`): The passphrase of the private key. Using the **Pgp decrypt** operation ```xml ``` > [!NOTE] Use the `validateIfSignatureFound` parameter to automatically validate embedded signatures > during decryption. For all available parameters, refer to > [cryptography-module-reference.adoc#PgpDecrypt](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference#PgpDecrypt). ## Sign Sign a message using a configured private key. Example: PGP Configuration ```xml ``` Using the **Pgp sign** operation: ```xml ``` ## Validate a Signature Validate the signature of a message using the signer’s public key. Example: PGP Configuration ```xml ``` Using the **Pgp validate** operation: ```xml ``` ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-examples) - [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference) --- product: Cryptography Module version: 2.0 --- # Configuring XML Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Mule runtime engine (Mule) XML Cryptography enables you to encrypt entire XML messages or just specific parts of them. Unlike PGP, which combines compression, XML encryption focuses on securing the content within XML structures. While JCE Cryptography offers broader encryption for various data, XML Cryptography is designed for the structured nature of XML, letting you precisely encrypt specific elements or the whole document. This is useful for protecting sensitive data like social security numbers or credit card details within an XML message. Use the Cryptography Module XML operations for encryption and decryption. > [!NOTE] If you’re upgrading to Cryptography Module 2.0, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-upgrade). ## Configure XML Encryption Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module XML operation to the canvas flow. ![A palette menu for adding password-based encryption modules in a cryptographic flow](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-pbe-add.png) ![A palette menu for adding XML cryptographic operations](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-xml-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Keystore**, **Type** (JKS, JCEKS, PKCS12) and **Password**. You can also add symmetric or asymmetric key information to be used in the sign operations: ![Global configuration properties for Crypto JCE](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-jce-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration panel for XML signing](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-xml-config.png) 4. Select **Digest Algorithm**, **Canonicalization Algorithm**, **Type**, and **Element path**. ## Encrypt This example configures a keystore that contains a symmetric key that will be used for encryption: Example: JCE Configuration ```xml ``` In this example, the **Xml encrypt** operation encrypts a specific element of the XML document: ```xml ``` The `elementPath` is an XPath expression that identifies the element to encrypt. Depending on your needs, you can use a symmetric or asymmetric key for encrypting an XML document. ## Decrypt This example configures the decryption: Example: JCE Configuration ```xml ``` In this example, the **Xml decrypt** operation decrypts an XML document. The operation uses the asymmetric key stored in the referenced keystore. ```xml ``` Depending on your needs, you can use a symmetric or asymmetric key for decryption. ## Sign This examples shows the JCE configuration to sign: Example: JCE Configuration ```xml ``` In this example, the **Xml sign** operation uses the asymmetric key to sign an XML document by creating an XML envelope and inserting the signature inside the content that is being signed. Example: Enveloped Signature ```xml ``` In this example, a detached XML signature is created based on an element of the XML document. Instead of being inserted in the signed content, the detached signature is returned as a separate XML element. Example: Detached Signature ```xml ``` ### Select the Signing Algorithm In the **Xml Sign** operation, the `digestAlgorithm` parameter defines the hashing algorithm applied to the content before signing, for example SHA1, SHA256, or SHA512. However, the final XML signature algorithm is not manually selected. It is automatically determined based on the type of key (RSA, DSA, EC, HMAC) configured in the module. The signing process combines the chosen hash algorithm `digestAlgorithm` with the key type to produce the signature method used in the XML document. For example: - An RSA key with `digestAlgorithm=SHA256` results in the `rsa-sha256` signature method. - A DSA key with `digestAlgorithm=SHA1` results in the `dsa-sha1` signature method. - An EC key with `digestAlgorithm=SHA256` results in the `ecdsa-sha256` signature method. If you want to use a different signature method, you must change the type of key in the `digestAlgorithm` parameter configuration. It is not currently possible to manually select the signature method within the operation. ## Validate a Signature This examples shows the JCE configuration to validate a signature: Example: JCE Configuration ```xml ``` In this example, the asymmetric key is used to validate the signature of the XML element specified by the `elementPath` XPath expression. Example: Using the Validate Operation ```xml ``` If the document has multiple signatures, set `elementPath` to select the signature to validate. Specify a signed element using an XPath expression to validate the signature for that element. ## Target a Custom Namespace by Using Element Path To sign or validate an XML element that is inside a custom namespace, specify the namespace by using the XPath functions: [namespace-uri](https://developer.mozilla.org/en-US/docs/Web/XML/XPath/Reference/Functions/namespace-uri) and [local-name](https://developer.mozilla.org/en-US/docs/Web/XML/XPath/Reference/Functions/local-name). For example, consider the following document: ```xml ``` To target the content of `FirstElement` inside `soap:Envelope`, you specify the `xmlns:soap` namespace. The XML schema for `xmlns:soap` is defined in `[http://www.w3.org/2003/05/soap-envelope/](http://www.w3.org/2003/05/soap-envelope/)`. The following example shows an `xml-sign` operation configured to sign `FirstElement`: ```xml ``` Note that the `elementPath` expression specifies the `xmlns:soap` namespace. ## See Also - [Cryptography Module Reference 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference) --- product: Cryptography Module version: 2.1 --- # Configuring XML Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Mule runtime engine (Mule) XML Cryptography enables you to encrypt entire XML messages or just specific parts of them. Unlike PGP, which combines compression, XML encryption focuses on securing the content within XML structures. While JCE Cryptography offers broader encryption for various data, XML Cryptography is designed for the structured nature of XML, letting you precisely encrypt specific elements or the whole document. This is useful for protecting sensitive data like social security numbers or credit card details within an XML message. Use the Cryptography Module XML operations for encryption and decryption. > [!NOTE] If you’re upgrading to Cryptography Module 2.1, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.x](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-upgrade). ## Configure XML Encryption Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module XML operation to the canvas flow. ![A palette menu for adding password-based encryption modules in a cryptographic flow](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-pbe-add.png) ![A palette menu for adding XML cryptographic operations](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-xml-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Keystore**, **Type** (JKS, JCEKS, PKCS12) and **Password**. You can also add symmetric or asymmetric key information to be used in the sign operations: ![Global configuration properties for Crypto JCE](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-jce-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration panel for XML signing](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-xml-config.png) 4. Select **Digest Algorithm**, **Canonicalization Algorithm**, **Type**, and **Element path**. ## Encrypt This example configures a keystore that contains a symmetric key that will be used for encryption: Example: JCE Configuration ```xml ``` In this example, the **Xml encrypt** operation encrypts a specific element of the XML document: ```xml ``` The `elementPath` is an XPath expression that identifies the element to encrypt. Depending on your needs, you can use a symmetric or asymmetric key for encrypting an XML document. ## Decrypt This example configures the decryption: Example: JCE Configuration ```xml ``` In this example, the **Xml decrypt** operation decrypts an XML document. The operation uses the asymmetric key stored in the referenced keystore. ```xml ``` Depending on your needs, you can use a symmetric or asymmetric key for decryption. ## Sign This examples shows the JCE configuration to sign: Example: JCE Configuration ```xml ``` In this example, the **Xml sign** operation uses the asymmetric key to sign an XML document by creating an XML envelope and inserting the signature inside the content that is being signed. Example: Enveloped Signature ```xml ``` In this example, a detached XML signature is created based on an element of the XML document. Instead of being inserted in the signed content, the detached signature is returned as a separate XML element. Example: Detached Signature ```xml ``` ### Select the Signing Algorithm In the **Xml Sign** operation, the `digestAlgorithm` parameter defines the hashing algorithm applied to the content before signing, for example SHA1, SHA256, or SHA512. However, the final XML signature algorithm is not manually selected. It is automatically determined based on the type of key (RSA, DSA, EC, HMAC) configured in the module. The signing process combines the chosen hash algorithm `digestAlgorithm` with the key type to produce the signature method used in the XML document. For example: - An RSA key with `digestAlgorithm=SHA256` results in the `rsa-sha256` signature method. - A DSA key with `digestAlgorithm=SHA1` results in the `dsa-sha1` signature method. - An EC key with `digestAlgorithm=SHA256` results in the `ecdsa-sha256` signature method. If you want to use a different signature method, you must change the type of key in the `digestAlgorithm` parameter configuration. It is not currently possible to manually select the signature method within the operation. ## Validate a Signature This examples shows the JCE configuration to validate a signature: Example: JCE Configuration ```xml ``` In this example, the asymmetric key is used to validate the signature of the XML element specified by the `elementPath` XPath expression. Example: Using the Validate Operation ```xml ``` If the document has multiple signatures, set `elementPath` to select the signature to validate. Specify a signed element using an XPath expression to validate the signature for that element. ## Target a Custom Namespace by Using Element Path To sign or validate an XML element that is inside a custom namespace, specify the namespace by using the XPath functions: [namespace-uri](https://developer.mozilla.org/en-US/docs/Web/XML/XPath/Reference/Functions/namespace-uri) and [local-name](https://developer.mozilla.org/en-US/docs/Web/XML/XPath/Reference/Functions/local-name). For example, consider the following document: ```xml ``` To target the content of `FirstElement` inside `soap:Envelope`, you specify the `xmlns:soap` namespace. The XML schema for `xmlns:soap` is defined in `[http://www.w3.org/2003/05/soap-envelope/](http://www.w3.org/2003/05/soap-envelope/)`. The following example shows an `xml-sign` operation configured to sign `FirstElement`: ```xml ``` Note that the `elementPath` expression specifies the `xmlns:soap` namespace. ## See Also - [Cryptography Module Reference 2.1](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Configuring XML Cryptography > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Mule runtime engine (Mule) XML Cryptography enables you to encrypt entire XML messages or just specific parts of them. Unlike PGP, which combines compression, XML encryption focuses on securing the content within XML structures. While JCE Cryptography offers broader encryption for various data, XML Cryptography is designed for the structured nature of XML, letting you precisely encrypt specific elements or the whole document. This is useful for protecting sensitive data like social security numbers or credit card details within an XML message. Use the Cryptography Module XML operations for encryption and decryption. > [!NOTE] If you’re upgrading to Cryptography Module 2.1, configure the required Java dependencies > so your project compiles. For details, refer to > [Upgrading and Migrating Cryptography Module 2.x](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-upgrade). ## Configure XML Encryption Operations in Anypoint Studio Follow these steps: 1. In Anypoint Studio, drag a Cryptography Module XML operation to the canvas flow. ![A palette menu for adding password-based encryption modules in a cryptographic flow](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-pbe-add.png) ![A palette menu for adding XML cryptographic operations](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-xml-add.png) 2. In the operation configuration window, select an existing **Module configuration**, or create a new one by configuring the **Keystore**, **Type** (JKS, JCEKS, PKCS12) and **Password**. You can also add symmetric or asymmetric key information to be used in the sign operations: ![Global configuration properties for Crypto JCE](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-jce-global-config.png) 3. Configure **Key selection** by using a **Key id** value previously defined in the module configuration, or define a new one for this operation: ![A configuration panel for XML signing](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-xml-config.png) 4. Select **Digest Algorithm**, **Canonicalization Algorithm**, **Type**, and **Element path**. ## Encrypt This example configures a keystore that contains a symmetric key that will be used for encryption: Example: JCE Configuration ```xml ``` In this example, the **Xml encrypt** operation encrypts a specific element of the XML document: ```xml ``` The `elementPath` is an XPath expression that identifies the element to encrypt. Depending on your needs, you can use a symmetric or asymmetric key for encrypting an XML document. ## Decrypt This example configures the decryption: Example: JCE Configuration ```xml ``` In this example, the **Xml decrypt** operation decrypts an XML document. The operation uses the asymmetric key stored in the referenced keystore. ```xml ``` Depending on your needs, you can use a symmetric or asymmetric key for decryption. ## Sign This examples shows the JCE configuration to sign: Example: JCE Configuration ```xml ``` In this example, the **Xml sign** operation uses the asymmetric key to sign an XML document by creating an XML envelope and inserting the signature inside the content that is being signed. Example: Enveloped Signature ```xml ``` In this example, a detached XML signature is created based on an element of the XML document. Instead of being inserted in the signed content, the detached signature is returned as a separate XML element. Example: Detached Signature ```xml ``` ### Select the Signing Algorithm In the **Xml Sign** operation, the `digestAlgorithm` parameter defines the hashing algorithm applied to the content before signing, for example SHA1, SHA256, or SHA512. However, the final XML signature algorithm is not manually selected. It is automatically determined based on the type of key (RSA, DSA, EC, HMAC) configured in the module. The signing process combines the chosen hash algorithm `digestAlgorithm` with the key type to produce the signature method used in the XML document. For example: - An RSA key with `digestAlgorithm=SHA256` results in the `rsa-sha256` signature method. - A DSA key with `digestAlgorithm=SHA1` results in the `dsa-sha1` signature method. - An EC key with `digestAlgorithm=SHA256` results in the `ecdsa-sha256` signature method. If you want to use a different signature method, you must change the type of key in the `digestAlgorithm` parameter configuration. It is not currently possible to manually select the signature method within the operation. ## Validate a Signature This examples shows the JCE configuration to validate a signature: Example: JCE Configuration ```xml ``` In this example, the asymmetric key is used to validate the signature of the XML element specified by the `elementPath` XPath expression. Example: Using the Validate Operation ```xml ``` If the document has multiple signatures, set `elementPath` to select the signature to validate. Specify a signed element using an XPath expression to validate the signature for that element. ## Target a Custom Namespace by Using Element Path To sign or validate an XML element that is inside a custom namespace, specify the namespace by using the XPath functions: [namespace-uri](https://developer.mozilla.org/en-US/docs/Web/XML/XPath/Reference/Functions/namespace-uri) and [local-name](https://developer.mozilla.org/en-US/docs/Web/XML/XPath/Reference/Functions/local-name). For example, consider the following document: ```xml ``` To target the content of `FirstElement` inside `soap:Envelope`, you specify the `xmlns:soap` namespace. The XML schema for `xmlns:soap` is defined in `[http://www.w3.org/2003/05/soap-envelope/](http://www.w3.org/2003/05/soap-envelope/)`. The following example shows an `xml-sign` operation configured to sign `FirstElement`: ```xml ``` Note that the `elementPath` expression specifies the `xmlns:soap` namespace. ## See Also - [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference) --- product: Cryptography Module version: 2.0 --- # Cryptography Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Cryptography Module provides cryptography capabilities to a Mule application. Its main features include: - Symmetric encryption and decryption of messages. - Asymmetric encryption and decryption of messages. - Message signing and signature validation of signed messages. The module supports these strategies to encrypt and sign your messages: - [JCE](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-jce) Provides cryptography capabilities of Java Cryptography Extension. - [PGP](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-pgp) Provides signing and encryption using Pretty Good Privacy. - [XML](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-xml) Provides signing and encryption of XML documents or elements. Additionally, the module offers two general operations to calculate and validate stream checksums. For details, refer to [Cryptography Module Reference 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference) ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Salesforce Help Center](https://help.salesforce.com/s/?language=en_US) --- product: Cryptography Module version: 2.1 --- # Cryptography Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Cryptography Module provides cryptography capabilities to a Mule application. Its main features include: - Symmetric encryption and decryption of messages. - Asymmetric encryption and decryption of messages. - Message signing and signature validation of signed messages. The module supports these strategies to encrypt and sign your messages: - [JCE](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-jce) Provides cryptography capabilities of Java Cryptography Extension. - [PGP](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-pgp) Provides signing and encryption using Pretty Good Privacy. - [XML](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-xml) Provides signing and encryption of XML documents or elements. Additionally, the module offers two general operations to calculate and validate stream checksums. For details, refer to [Cryptography Module Reference 2.1](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference) ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Salesforce Help Center](https://help.salesforce.com/s/?language=en_US) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Cryptography Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Cryptography Module provides cryptography capabilities to a Mule application. Its main features include: - Symmetric encryption and decryption of messages. - Asymmetric encryption and decryption of messages. - Message signing and signature validation of signed messages. The module supports these strategies to encrypt and sign your messages: - [JCE](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-jce) Provides cryptography capabilities of Java Cryptography Extension. - [PGP](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-pgp) Provides signing and encryption using Pretty Good Privacy. - [XML](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-xml) Provides signing and encryption of XML documents or elements. Additionally, the module offers two general operations to calculate and validate stream checksums. For details, refer to [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference) ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Salesforce Help Center](https://help.salesforce.com/s/?language=en_US) --- product: Cryptography Module version: 2.0 --- # Cryptography Module - Additional Configuration > For the full documentation index, see: https://docs.mulesoft.com/llms.txt After you complete basic Cryptography Module configuration, you can perform additional configuration tasks. ## Configure Use Random Initialization Vectors Configure the **Use random IVs** field to use random initialization vectors (IVs). If you configure this field, the decryption algorithm expects the IVs to be added to the beginning of the ciphertext during decryption. Follow these steps for the configuration: 1. In Anypoint Studio, drag a Cryptography Module operation to your flow, for example **Jce sign**. 2. Select the operation from the flow. 3. In the operation configuration screen, click the plus sign to access the module global configuration. 4. In the **Global Element Properties** window, enable the **Use random IVs** field. ![A configuration setting for Crypto JCE with options for keystore and random IV usage](/mulesoft/current/en-us/cryptography-module/2.0/_images/crypto-random-iv.png) In the **XML editor** window, the configuration looks like this: ```xml crypto:jce-config name="Crypto_Jce" doc:name="Crypto Jce" keystore="/Users/MuleSoft/Desktop/jcekeystore.jks" password="mulesoft" useRandomIVs="true"> ``` ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-examples) - [Cryptography Module Reference 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference) --- product: Cryptography Module version: 2.1 --- # Cryptography Module - Additional Configuration > For the full documentation index, see: https://docs.mulesoft.com/llms.txt After you complete basic Cryptography Module configuration, you can perform additional configuration tasks. ## Configure Use Random Initialization Vectors Configure the **Use random IVs** field to use random initialization vectors (IVs). If you configure this field, the decryption algorithm expects the IVs to be added to the beginning of the ciphertext during decryption. Follow these steps for the configuration: 1. In Anypoint Studio, drag a Cryptography Module operation to your flow, for example **Jce sign**. 2. Select the operation from the flow. 3. In the operation configuration screen, click the plus sign to access the module global configuration. 4. In the **Global Element Properties** window, enable the **Use random IVs** field. ![A configuration setting for Crypto JCE with options for keystore and random IV usage](/mulesoft/current/en-us/cryptography-module/2.1/_images/crypto-random-iv.png) In the **XML editor** window, the configuration looks like this: ```xml crypto:jce-config name="Crypto_Jce" doc:name="Crypto Jce" keystore="/Users/MuleSoft/Desktop/jcekeystore.jks" password="mulesoft" useRandomIVs="true"> ``` ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-examples) - [Cryptography Module Reference 2.1](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Cryptography Module - Additional Configuration > For the full documentation index, see: https://docs.mulesoft.com/llms.txt After you complete basic Cryptography Module configuration, you can perform additional configuration tasks. ## Configure Use Random Initialization Vectors Configure the **Use random IVs** field to use random initialization vectors (IVs). If you configure this field, the decryption algorithm expects the IVs to be added to the beginning of the ciphertext during decryption. Follow these steps for the configuration: 1. In Anypoint Studio, drag a Cryptography Module operation to your flow, for example **Jce sign**. 2. Select the operation from the flow. 3. In the operation configuration screen, click the plus sign to access the module global configuration. 4. In the **Global Element Properties** window, enable the **Use random IVs** field. ![A configuration setting for Crypto JCE with options for keystore and random IV usage](/mulesoft/current/en-us/cryptography-module/latest/_images/crypto-random-iv.png) In the **XML editor** window, the configuration looks like this: ```xml crypto:jce-config name="Crypto_Jce" doc:name="Crypto Jce" keystore="/Users/MuleSoft/Desktop/jcekeystore.jks" password="mulesoft" useRandomIVs="true"> ``` ## See Also - [Cryptography Module Examples](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-examples) - [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference) --- product: Cryptography Module version: 2.0 --- # Cryptography Module Examples > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Cryptography Module examples help you use JCE (PBE and KBE), PGP, and XML operations. - [Configuring JCE Cryptography](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-jce) Configure the JCE (PBE and KBE) encryption operations. - [Configuring PGP Cryptography](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-pgp) Configure the PGP encryption operations. - [Configuring XML Cryptography](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-xml) Configure the XML encryption operations. - [Cryptography Module Additional Configuration](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-additional-configuration) Configure the **Use random IVs** field to use random initialization vectors (IVs). ## See Also - [Cryptography Module Reference 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference) - [Salesforce Help Center](https://help.salesforce.com/s/?language=en_US) --- product: Cryptography Module version: 2.1 --- # Cryptography Module Examples > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Cryptography Module examples help you use JCE (PBE and KBE), PGP, and XML operations. - [Configuring JCE Cryptography](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-jce) Configure the JCE (PBE and KBE) encryption operations. - [Configuring PGP Cryptography](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-pgp) Configure the PGP encryption operations. - [Configuring XML Cryptography](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-xml) Configure the XML encryption operations. - [Cryptography Module Additional Configuration](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-additional-configuration) Configure the **Use random IVs** field to use random initialization vectors (IVs). ## See Also - [Cryptography Module Reference 2.1](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference) - [Salesforce Help Center](https://help.salesforce.com/s/?language=en_US) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Cryptography Module Examples > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Cryptography Module examples help you use JCE (PBE and KBE), PGP, and XML operations. - [Configuring JCE Cryptography](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-jce) Configure the JCE (PBE and KBE) encryption operations. - [Configuring PGP Cryptography](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-pgp) Configure the PGP encryption operations. - [Configuring XML Cryptography](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-xml) Configure the XML encryption operations. - [Cryptography Module Additional Configuration](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-additional-configuration) Configure the **Use random IVs** field to use random initialization vectors (IVs). ## See Also - [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference) - [Salesforce Help Center](https://help.salesforce.com/s/?language=en_US) --- product: Cryptography Module version: 2.0 --- # Cryptography Module Reference 2.0 > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Cryptography Module provides cryptography capabilities to a Mule application. ## Configurations --- ### Jce JCE configuration for Java keystores and inline keys. #### Parameters
NameTypeDescriptionDefault ValueRequired

Name

String

Name for this configuration. Connectors reference the configuration with this name.

x

Keystore

String

Path to the keystore file.

Type

Enumeration, one of:

  • JKS

  • JCEKS

  • PKCS12

  • BCFKS

Type of the keystore.

x

Password

String

Password for unlocking the keystore.

Jce Key Infos

List of keys to be considered, with internal IDs for referencing them.

Use random IVs

Boolean

Use random initial vectors (IVs) for CBC algorithms. In case of decryption, it assumes IV is prepended on the ciphertext.

false

Name

String

ID used to reference this configuration.

x

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

## Supported Operations - [Jce Decrypt](#JceDecrypt) - [Jce Encrypt](#JceEncrypt) - [Jce Sign](#JceSign) - [Jce Validate](#JceValidate) - [Pgp Decrypt](#PgpDecrypt) - [Pgp Encrypt](#PgpEncrypt) - [Pgp Encrypt And Sign](#PgpEncryptAndSign) - [Pgp Encrypt Binary](#PgpEncryptBinary) - [Pgp Sign](#PgpSign) - [Pgp Sign Binary](#PgpSignBinary) - [Pgp Validate](#PgpValidate) - [Xml Decrypt](#XmlDecrypt) - [Xml Encrypt](#XmlEncrypt) - [Xml Sign](#XmlSign) - [Xml Validate](#XmlValidate) - [Calculate Checksum](#CalculateChecksum) - [Validate Checksum](#ValidateChecksum) --- ### Pgp Keystore configuration for GPG. Contains a list of keys with internal names to use in the operations. #### Parameters
NameTypeDescriptionDefault ValueRequired

Name

String

Name for this configuration. Connectors reference the configuration with this name.

x

Public Keyring

String

Public key ring file.

Private Keyring

String

Private key ring file.

Pgp Key Infos

Array of One of:

List of keys to be considered, with internal IDs for referencing them.

Name

String

ID used to reference this configuration.

x

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

## Operations ## Jce Decrypt `` Decrypt a stream using JCE, with a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to decrypt

#[payload]

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Cipher

String

A raw cipher string in the form "algorithm/mode/padding" according to the Java crypto documentation, for example AES/CBC/PKCS5Padding. Note that GCM mode is currently not supported, and not all algorithm/mode/padding combinations are valid.

Algorithm

Enumeration, one of:

  • AES

  • AESWrap

  • ARCFOUR

  • Blowfish

  • DES

  • DESede

  • RC2

  • DESedeWrap

  • RSA

Algorithm from a list of valid definitions, this is preferred.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE ## Jce Encrypt `` Encrypt a stream using JCE, with a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Cipher

String

A raw cipher string in the form "algorithm/mode/padding" according to the Java crypto documentation, for example AES/CBC/PKCS5Padding. Note that GCM mode is currently not supported, and not all algorithm/mode/padding combinations are valid.

Algorithm

Enumeration, one of:

  • AES

  • AESWrap

  • ARCFOUR

  • Blowfish

  • DES

  • DESede

  • RC2

  • DESedeWrap

  • RSA

Algorithm from a list of valid definitions, this is preferred.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS ## Jce Sign `` Sign a stream using JCE, with a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to sign

#[payload]

Algorithm

Enumeration, one of:

  • MD2withRSA

  • MD5withRSA

  • SHA1withRSA

  • SHA224withRSA

  • SHA256withRSA

  • SHA384withRSA

  • SHA512withRSA

  • NONEwithDSA

  • SHA1withDSA

  • SHA224withDSA

  • SHA256withDSA

  • HmacMD5

  • HmacSHA1

  • HmacSHA224

  • HmacSHA256

  • HmacSHA384

  • HmacSHA512

the algorithm used for signing

HmacSHA256

Output Mime Type

String

The mime type of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

String

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Jce Validate `` Validate a stream against a signature, using a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Value

Any

the message to authenticate

#[payload]

Expected

String

the signature to validate

x

Algorithm

Enumeration, one of:

  • MD2withRSA

  • MD5withRSA

  • SHA1withRSA

  • SHA224withRSA

  • SHA256withRSA

  • SHA384withRSA

  • SHA512withRSA

  • NONEwithDSA

  • SHA1withDSA

  • SHA224withDSA

  • SHA256withDSA

  • HmacMD5

  • HmacSHA1

  • HmacSHA224

  • HmacSHA256

  • HmacSHA384

  • HmacSHA512

the algorithm used for signing

HmacSHA256

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Error Mappings

Array of Error Mapping

Set of error mappings

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Xml Decrypt `` Decrypt the XML document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the document to decrypt

#[payload]

Element Path

String

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE ## Xml Encrypt `` Encrypt the XML document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the document to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • AES_CBC

  • AES_GCM

  • TRIPLEDES

the algorithm for encryption

AES_CBC

Element Path

String

the path to the element to encrypt, if empty the whole document is considered

Encrypt Content

Boolean

encrypt the XML element or its content, if false the whole XML element is encrypted.

true

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Encryption Algorithm

Enumeration, one of:

  • RSA15

  • RSA_OAEP

  • RSA_OAEP_11

RSA_OAEP

Canonicalization algorithm

Enumeration, one of:

  • EXCLUSIVE

  • EXCLUSIVE_WITH_COMMENTS

  • INCLUSIVE

  • INCLUSE_WITH_COMMENTS

EXCLUSIVE

Digest Algorithm

Enumeration, one of:

  • RIPEMD160

  • SHA1

  • SHA256

  • SHA512

SHA512

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS ## Xml Sign `` Sign an XML document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the XML document to sign

#[payload]

Digest Algorithm

Enumeration, one of:

  • RIPEMD160

  • SHA1

  • SHA256

  • SHA512

the hashing algorithm for signing

SHA256

Canonicalization Algorithm

Enumeration, one of:

  • EXCLUSIVE

  • EXCLUSIVE_WITH_COMMENTS

  • INCLUSIVE

  • INCLUSE_WITH_COMMENTS

the canonicalization method for whitespace and namespace unification

EXCLUSIVE

Type

Enumeration, one of:

  • DETACHED

  • ENVELOPED

  • ENVELOPING

the type of signature to create

ENVELOPED

Element Path

String

for internally detached signatures, an unambiguous XPath expression resolving to the element to sign

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Xml Validate `` Validate an XML signed document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the document to verify (includes the signature)

#[payload]

Element Path

String

for internally detached signatures, an unambiguous XPath expression resolving to the signed element

Use Inline Certificate If Present

Boolean

Use inline defined certificate if found

false

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Error Mappings

Array of Error Mapping

Set of error mappings

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Pgp Decrypt `` Decrypt a stream using PGP, giving the original data as a result. The decryption is done with the private key, so the secret passphrase must be provided. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to decrypt

#[payload]

File Name

String

the internal file name to decrypt, if not present the first will be used

Validate If Signature Found

Boolean

If the message being decrypted contains a signature, choose whether or not to validate the decrypted message against it

false

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PASSPHRASE ## Pgp Encrypt `` Encrypt a stream using PGP, giving an ASCII-armored stream output as a result. The encryption is done with the public key of the recipient, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • IDEA

  • TRIPLE_DES

  • CAST5

  • BLOWFISH

  • SAFER

  • DES

  • AES_128

  • AES_192

  • AES_256

  • TWOFISH

  • CAMELLIA_128

  • CAMELLIA_192

  • CAMELLIA_256

the symmetric algorithm to use for encryption

AES_256

File Name

String

the internal file name to use in the resulting PGP header

stream

Disable MDC

Boolean

If set, MDC (modification detection code) will not be used during encryption

false

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY ## Pgp Encrypt And Sign `` Encrypt a stream using PGP, giving an ASCII-armored stream output as a result. The encryption is done with the public key of the recipient, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • IDEA

  • TRIPLE_DES

  • CAST5

  • BLOWFISH

  • SAFER

  • DES

  • AES_128

  • AES_192

  • AES_256

  • TWOFISH

  • CAMELLIA_128

  • CAMELLIA_192

  • CAMELLIA_256

the symmetric algorithm to use for encryption

AES_256

File Name

String

the internal file name to use in the resulting PGP header

stream

Encryption Key Selection

the key used to encrypt the message.

x

Sign Key Selection

the key used to sign the message.

x

Disable MDC

Boolean

If set, MDC (modification detection code) will not be used during encryption

false

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY ## Pgp Encrypt Binary `` Encrypt a stream using PGP, giving a binary output as a result. The encryption is done with the public key of the recipient, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • IDEA

  • TRIPLE_DES

  • CAST5

  • BLOWFISH

  • SAFER

  • DES

  • AES_128

  • AES_192

  • AES_256

  • TWOFISH

  • CAMELLIA_128

  • CAMELLIA_192

  • CAMELLIA_256

the symmetric algorithm to use for encryption

AES_256

File Name

String

the internal file name to use in the resulting PGP header

stream

Disable MDC

Boolean

If set, MDC (modification detection code) will not be used during encryption

false

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY ## Pgp Sign `` Create a detached (standalone) PGP signature of the stream. The signing is done with the private key of the sender, so the secret passphrase must be provided. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to sign

#[payload]

Algorithm

Enumeration, one of:

  • MD5

  • RIPEMD160

  • TIGER_192

  • HAVAL_5_160

  • DOUBLE_SHA

  • SHA1

  • SHA224

  • SHA256

  • SHA384

  • SHA512

the digest (or hashing) algorithm

SHA256

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Pgp Sign Binary `` Create a detached (standalone) PGP signature of the stream. The signing is done with the private key of the sender, so the secret passphrase must be provided. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to sign

#[payload]

Algorithm

Enumeration, one of:

  • MD5

  • RIPEMD160

  • TIGER_192

  • HAVAL_5_160

  • DOUBLE_SHA

  • SHA1

  • SHA224

  • SHA256

  • SHA384

  • SHA512

the digest (or hashing) algorithm

SHA256

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Pgp Validate `` Validate a PGP signature against a stream, to authenticate it. The validation is done with the public key of the sender, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Value

Any

the message to authenticate

#[payload]

Expected

Any

the signature

x

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Error Mappings

Array of Error Mapping

Set of error mappings

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Calculate Checksum `` Calculate the checksum of the stream. ### Parameters
NameTypeDescriptionDefault ValueRequired

Algorithm

Enumeration, one of:

  • CRC32

  • MD2

  • MD5

  • SHA_1

  • SHA_256

  • SHA_512

the checksum algorithm

SHA_512

Content

Any

the content for calculating the checksum

#[payload]

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

String

### Throws - CRYPTO:CHECKSUM ## Jce Decrypt Pbe `` Decrypt a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to decrypt

#[payload]

Algorithm

String

the algorithm for generating a key from the password

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding (FIPS)

Password

String

the password for decryption

x

Password Salt

String

the password salt used to sign. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

0

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE ## Jce Encrypt Pbe `` Encrypt a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to encrypt

#[payload]

Algorithm

String

the algorithm for generating a key from the password

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding

Password

String

the password for encryption

x

Password Salt

String

the password salt used to sign. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

x

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

x

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS ## Jce Sign Pbe `` Sign a stream using JCE, with a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to sign

#[payload]

Algorithm

String

the algorithm used for signing

PBKDF2withHmacSHA512

Password

String

the password used to sign

x

Password Salt

String

the password salt used to sign. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

x

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

x

Output Mime Type

String

The mime type of the payload that this operation outputs.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

String

### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Jce Validate Pbe `` Validate a stream against a signature, using a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Value

Any

the message to authenticate

#[payload]

Expected

String

the signature to validate

x

Algorithm

String

the algorithm used for signing

PBKDF2withHmacSHA512

Password

String

the password used to sign

x

Password Salt

String

the password salt used to sign. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

0

Error Mappings

Array of Error Mapping

Set of error mappings

### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Pgp Binary To Armored `` Converts an encrypted PGP message or a PGP signature to an ASCII armored representation, suitable for plain text channels. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to convert

#[payload]

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### Throws - CRYPTO:PARAMETERS ## Validate Checksum `` Validate the checksum of the stream against an expected checksum. ### Parameters
NameTypeDescriptionDefault ValueRequired

Algorithm

Enumeration, one of:

  • CRC32

  • MD2

  • MD5

  • SHA_1

  • SHA_256

  • SHA_512

the checksum algorithm

SHA_512

Value

Any

the content for calculating the checksum

#[payload]

Expected

String

the expected checksum as an hexadecimal string

x

Error Mappings

Array of Error Mapping

Set of error mappings

### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Types ### Expiration Policy Configures an expiration policy strategy.
FieldTypeDescriptionDefault ValueRequired

Max Idle Time

Number

Configures the maximum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

Time unit for the Max Idle Time field.

### Repeatable In Memory Stream Configures the in-memory streaming strategy by which the request fails if the data exceeds the MAX buffer size. Always run performance tests to find the optimal buffer size for your specific use case.
FieldTypeDescriptionDefault ValueRequired

Initial Buffer Size

Number

Initial amount of memory to allocate to the data stream. If the streamed data exceeds this value, the buffer expands by Buffer Size Increment, with an upper limit of Max In Memory Size value.

Buffer Size Increment

Number

This is by how much the buffer size expands if it exceeds its initial size. Setting a value of zero or lower means that the buffer should not expand, meaning that a STREAM_MAXIMUM_SIZE_EXCEEDED error is raised when the buffer gets full.

Max Buffer Size

Number

Maximum size of the buffer. If the buffer size exceeds this value, Mule raises a STREAM_MAXIMUM_SIZE_EXCEEDED error. A value of less than or equal to 0 means no limit.

Buffer Unit

Enumeration, one of:

  • BYTE

  • KB

  • MB

  • GB

Unit for the Initial Buffer Size, Buffer Size Increment, and Buffer Unit fields.

### Repeatable File Store Stream Configures the repeatable file-store streaming strategy by which Mule keeps a portion of the stream content in memory. If the stream content is larger than the configured buffer size, Mule backs up the buffer’s content to disk and then clears the memory.
FieldTypeDescriptionDefault ValueRequired

In Memory Size

Number

Maximum amount of memory that the stream can use for data. If the amount of memory exceeds this value, Mule buffers the content to disk. To optimize performance:

  • Configure a larger buffer size to avoid the number of times Mule needs to write the buffer on disk. This increases performance, but it also limits the number of concurrent requests your application can process, because it requires additional memory.

  • Configure a smaller buffer size to decrease memory load at the expense of response time.

Buffer Unit

Enumeration, one of:

  • BYTE

  • KB

  • MB

  • GB

Unit for the In Memory Size field.

### Error Mapping
FieldTypeDescriptionDefault ValueRequired

Source

Enumeration, one of:

  • ANY

  • REDELIVERY_EXHAUSTED

  • TRANSFORMATION

  • EXPRESSION

  • SECURITY

  • CLIENT_SECURITY

  • SERVER_SECURITY

  • ROUTING

  • CONNECTIVITY

  • RETRY_EXHAUSTED

  • TIMEOUT

Target

String

x

### Pgp Key Selection
FieldTypeDescriptionDefault ValueRequired

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

### Pgp Asymmetric Key Info
FieldTypeDescriptionDefault ValueRequired

Key Id

String

Internal key ID for referencing from operations.

x

Key Pair Identifier

A way to identify the key inside the keystore.

x

Passphrase

String

The password for unlocking the secret part of the key.

### Pgp Asymmetric Key Identifier
FieldTypeDescriptionDefault ValueRequired

Fingerprint

String

Principal

String

### Jce Asymmetric Key Info
FieldTypeDescriptionDefault ValueRequired

Key Id

String

Internal key ID for referencing from operations.

x

Alias

String

Alias of the key in the keystore.

x

Password

String

Password used to unlock the private part of the key.

### Jce Symmetric Key Info
FieldTypeDescriptionDefault ValueRequired

Key Id

String

Internal key ID for referencing from operations.

x

Alias

String

Alias of the key in the keystore.

x

Password

String

Password used to unlock the key.

x

--- product: Cryptography Module version: 2.1 --- # Cryptography Module Reference 2.1 > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Cryptography Module provides cryptography capabilities to a Mule application. ## Configurations --- ### Jce JCE configuration for Java keystores and inline keys. #### Parameters
NameTypeDescriptionDefault ValueRequired

Name

String

Name for this configuration. Connectors reference the configuration with this name.

x

Keystore

String

Path to the keystore file.

Type

Enumeration, one of:

  • JKS

  • JCEKS

  • PKCS12

  • BCFKS

Type of the keystore.

x

Password

String

Password for unlocking the keystore.

Jce Key Infos

List of keys to be considered, with internal IDs for referencing them.

Use random IVs

Boolean

Use random initial vectors (IVs) for CBC algorithms. In case of decryption, it assumes IV is prepended on the ciphertext.

false

Name

String

ID used to reference this configuration.

x

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

## Supported Operations - [Jce Decrypt](#JceDecrypt) - [Jce Encrypt](#JceEncrypt) - [Jce Sign](#JceSign) - [Jce Validate](#JceValidate) - [Pgp Decrypt](#PgpDecrypt) - [Pgp Encrypt](#PgpEncrypt) - [Pgp Encrypt And Sign](#PgpEncryptAndSign) - [Pgp Encrypt Binary](#PgpEncryptBinary) - [Pgp Sign](#PgpSign) - [Pgp Sign Binary](#PgpSignBinary) - [Pgp Validate](#PgpValidate) - [Xml Decrypt](#XmlDecrypt) - [Xml Encrypt](#XmlEncrypt) - [Xml Sign](#XmlSign) - [Xml Validate](#XmlValidate) - [Calculate Checksum](#CalculateChecksum) - [Validate Checksum](#ValidateChecksum) --- ### Pgp Keystore configuration for GPG. Contains a list of keys with internal names to use in the operations. #### Parameters
NameTypeDescriptionDefault ValueRequired

Name

String

Name for this configuration. Connectors reference the configuration with this name.

x

Public Keyring

String

Public key ring file.

Private Keyring

String

Private key ring file.

Pgp Key Infos

Array of One of:

List of keys to be considered, with internal IDs for referencing them.

Name

String

ID used to reference this configuration.

x

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

## Operations ## Jce Decrypt `` Decrypt a stream using JCE, with a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to decrypt

#[payload]

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Cipher

String

A raw cipher string in the form "algorithm/mode/padding" according to the Java crypto documentation, for example AES/CBC/PKCS5Padding. Note that GCM mode is currently not supported, and not all algorithm/mode/padding combinations are valid.

Algorithm

Enumeration, one of:

  • AES

  • AESWrap

  • ARCFOUR

  • Blowfish

  • DES

  • DESede

  • RC2

  • DESedeWrap

  • RSA

Algorithm from a list of valid definitions, this is preferred.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE ## Jce Encrypt `` Encrypt a stream using JCE, with a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Cipher

String

A raw cipher string in the form "algorithm/mode/padding" according to the Java crypto documentation, for example AES/CBC/PKCS5Padding. Note that GCM mode is currently not supported, and not all algorithm/mode/padding combinations are valid.

Algorithm

Enumeration, one of:

  • AES

  • AESWrap

  • ARCFOUR

  • Blowfish

  • DES

  • DESede

  • RC2

  • DESedeWrap

  • RSA

Algorithm from a list of valid definitions, this is preferred.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS ## Jce Sign `` Sign a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to sign

#[payload]

Algorithm

Enumeration, one of:

  • MD2withRSA

  • MD5withRSA

  • SHA1withRSA

  • SHA224withRSA

  • SHA256withRSA

  • SHA384withRSA

  • SHA512withRSA

  • NONEwithDSA

  • SHA1withDSA

  • SHA224withDSA

  • SHA256withDSA

  • HmacMD5

  • HmacSHA1

  • HmacSHA224

  • HmacSHA256

  • HmacSHA384

  • HmacSHA512

the algorithm used for signing

HmacSHA256

Output Mime Type

String

The mime type of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

String

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Jce Validate `` Validate a stream against a signature, using a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Value

Any

the message to authenticate

#[payload]

Expected

String

the signature to validate

x

Algorithm

Enumeration, one of:

  • MD2withRSA

  • MD5withRSA

  • SHA1withRSA

  • SHA224withRSA

  • SHA256withRSA

  • SHA384withRSA

  • SHA512withRSA

  • NONEwithDSA

  • SHA1withDSA

  • SHA224withDSA

  • SHA256withDSA

  • HmacMD5

  • HmacSHA1

  • HmacSHA224

  • HmacSHA256

  • HmacSHA384

  • HmacSHA512

the algorithm used for signing

HmacSHA256

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Error Mappings

Array of Error Mapping

Set of error mappings

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Xml Decrypt `` Decrypt the XML document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the document to decrypt

#[payload]

Element Path

String

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE ## Xml Encrypt `` Encrypt the XML document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the document to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • AES_CBC

  • AES_GCM

  • TRIPLEDES

the algorithm for encryption

AES_CBC

Element Path

String

the path to the element to encrypt, if empty the whole document is considered

Encrypt Content

Boolean

encrypt the XML element or its content, if false the whole XML element is encrypted.

true

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Encryption Algorithm

Enumeration, one of:

  • RSA15

  • RSA_OAEP

  • RSA_OAEP_11

RSA_OAEP

Canonicalization algorithm

Enumeration, one of:

  • EXCLUSIVE

  • EXCLUSIVE_WITH_COMMENTS

  • INCLUSIVE

  • INCLUSE_WITH_COMMENTS

EXCLUSIVE

Digest Algorithm

Enumeration, one of:

  • RIPEMD160

  • SHA1

  • SHA256

  • SHA512

SHA512

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS ## Xml Sign `` Sign an XML document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the XML document to sign

#[payload]

Digest Algorithm

Enumeration, one of:

  • RIPEMD160

  • SHA1

  • SHA256

  • SHA512

the hashing algorithm for signing

SHA256

Canonicalization Algorithm

Enumeration, one of:

  • EXCLUSIVE

  • EXCLUSIVE_WITH_COMMENTS

  • INCLUSIVE

  • INCLUSE_WITH_COMMENTS

the canonicalization method for whitespace and namespace unification

EXCLUSIVE

Type

Enumeration, one of:

  • DETACHED

  • ENVELOPED

  • ENVELOPING

the type of signature to create

ENVELOPED

Element Path

String

for internally detached signatures, an unambiguous XPath expression resolving to the element to sign

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Xml Validate `` Validate an XML signed document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the document to verify (includes the signature)

#[payload]

Element Path

String

for internally detached signatures, an unambiguous XPath expression resolving to the signed element

Use Inline Certificate If Present

Boolean

Use inline defined certificate if found

false

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Error Mappings

Array of Error Mapping

Set of error mappings

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Pgp Decrypt `` Decrypt a stream using PGP, giving the original data as a result. The decryption is done with the private key, so the secret passphrase must be provided. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to decrypt

#[payload]

File Name

String

the internal file name to decrypt, if not present the first will be used

Validate If Signature Found

Boolean

If the message being decrypted contains a signature, choose whether or not to validate the decrypted message against it

false

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PASSPHRASE ## Pgp Encrypt `` Encrypt a stream using PGP, giving an ASCII-armored stream output as a result. The encryption is done with the public key of the recipient, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • IDEA

  • TRIPLE_DES

  • CAST5

  • BLOWFISH

  • SAFER

  • DES

  • AES_128

  • AES_192

  • AES_256

  • TWOFISH

  • CAMELLIA_128

  • CAMELLIA_192

  • CAMELLIA_256

the symmetric algorithm to use for encryption

AES_256

File Name

String

the internal file name to use in the resulting PGP header

stream

Disable MDC

Boolean

If set, MDC (modification detection code) will not be used during encryption

false

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY ## Pgp Encrypt And Sign `` Encrypt a stream using PGP, giving an ASCII-armored stream output as a result. The encryption is done with the public key of the recipient, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • IDEA

  • TRIPLE_DES

  • CAST5

  • BLOWFISH

  • SAFER

  • DES

  • AES_128

  • AES_192

  • AES_256

  • TWOFISH

  • CAMELLIA_128

  • CAMELLIA_192

  • CAMELLIA_256

the symmetric algorithm to use for encryption

AES_256

File Name

String

the internal file name to use in the resulting PGP header

stream

Encryption Key Selection

the key used to encrypt the message.

x

Sign Key Selection

the key used to sign the message.

x

Disable MDC

Boolean

If set, MDC (modification detection code) will not be used during encryption

false

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY ## Pgp Encrypt Binary `` Encrypt a stream using PGP, giving a binary output as a result. The encryption is done with the public key of the recipient, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • IDEA

  • TRIPLE_DES

  • CAST5

  • BLOWFISH

  • SAFER

  • DES

  • AES_128

  • AES_192

  • AES_256

  • TWOFISH

  • CAMELLIA_128

  • CAMELLIA_192

  • CAMELLIA_256

the symmetric algorithm to use for encryption

AES_256

File Name

String

the internal file name to use in the resulting PGP header

stream

Disable MDC

Boolean

If set, MDC (modification detection code) will not be used during encryption

false

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY ## Pgp Sign `` Create a detached (standalone) PGP signature of the stream. The signing is done with the private key of the sender, so the secret passphrase must be provided. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to sign

#[payload]

Algorithm

Enumeration, one of:

  • MD5

  • RIPEMD160

  • TIGER_192

  • HAVAL_5_160

  • DOUBLE_SHA

  • SHA1

  • SHA224

  • SHA256

  • SHA384

  • SHA512

the digest (or hashing) algorithm

SHA256

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Pgp Sign Binary `` Create a detached (standalone) PGP signature of the stream. The signing is done with the private key of the sender, so the secret passphrase must be provided. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to sign

#[payload]

Algorithm

Enumeration, one of:

  • MD5

  • RIPEMD160

  • TIGER_192

  • HAVAL_5_160

  • DOUBLE_SHA

  • SHA1

  • SHA224

  • SHA256

  • SHA384

  • SHA512

the digest (or hashing) algorithm

SHA256

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Pgp Validate `` Validate a PGP signature against a stream, to authenticate it. The validation is done with the public key of the sender, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Value

Any

the message to authenticate

#[payload]

Expected

Any

the signature

x

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Error Mappings

Array of Error Mapping

Set of error mappings

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Calculate Checksum `` Calculate the checksum of the stream. ### Parameters
NameTypeDescriptionDefault ValueRequired

Algorithm

Enumeration, one of:

  • CRC32

  • MD2

  • MD5

  • SHA_1

  • SHA_256

  • SHA_512

the checksum algorithm

SHA_512

Content

Any

the content for calculating the checksum

#[payload]

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

String

### Throws - CRYPTO:CHECKSUM ## Jce Decrypt Pbe `` Decrypt a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to decrypt

#[payload]

Algorithm

String

the algorithm for generating a key from the password

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding (FIPS)

Password

String

the password for decryption

x

Password Salt

String

Password salt used for encryption or decryption. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

0

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE ## Jce Encrypt Pbe `` Encrypt a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to encrypt

#[payload]

Algorithm

String

the algorithm for generating a key from the password

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding

Password

String

the password for encryption

x

Password Salt

String

Password salt used for encryption or decryption. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

x

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

x

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS ## Jce Sign Pbe `` Sign a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to sign

#[payload]

Algorithm

String

the algorithm used for signing

PBKDF2withHmacSHA512

Password

String

the password used to sign

x

Password Salt

String

Password salt used for encryption or decryption. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

x

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

x

Output Mime Type

String

The mime type of the payload that this operation outputs.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

String

### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Jce Validate Pbe `` Validate a stream against a signature, using a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Value

Any

the message to authenticate

#[payload]

Expected

String

the signature to validate

x

Algorithm

String

the algorithm used for signing

PBKDF2withHmacSHA512

Password

String

the password used to sign

x

Password Salt

String

Password salt used for encryption or decryption. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

0

Error Mappings

Array of Error Mapping

Set of error mappings

### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Pgp Binary To Armored `` Converts an encrypted PGP message or a PGP signature to an ASCII armored representation, suitable for plain text channels. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to convert

#[payload]

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### Throws - CRYPTO:PARAMETERS ## Validate Checksum `` Validate the checksum of the stream against an expected checksum. ### Parameters
NameTypeDescriptionDefault ValueRequired

Algorithm

Enumeration, one of:

  • CRC32

  • MD2

  • MD5

  • SHA_1

  • SHA_256

  • SHA_512

the checksum algorithm

SHA_512

Value

Any

the content for calculating the checksum

#[payload]

Expected

String

the expected checksum as an hexadecimal string

x

Error Mappings

Array of Error Mapping

Set of error mappings

### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Types ### Expiration Policy Configures an expiration policy strategy.
FieldTypeDescriptionDefault ValueRequired

Max Idle Time

Number

Configures the maximum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

Time unit for the Max Idle Time field.

### Repeatable In Memory Stream Configures the in-memory streaming strategy by which the request fails if the data exceeds the MAX buffer size. Always run performance tests to find the optimal buffer size for your specific use case.
FieldTypeDescriptionDefault ValueRequired

Initial Buffer Size

Number

Initial amount of memory to allocate to the data stream. If the streamed data exceeds this value, the buffer expands by Buffer Size Increment, with an upper limit of Max In Memory Size value.

Buffer Size Increment

Number

This is by how much the buffer size expands if it exceeds its initial size. Setting a value of zero or lower means that the buffer should not expand, meaning that a STREAM_MAXIMUM_SIZE_EXCEEDED error is raised when the buffer gets full.

Max Buffer Size

Number

Maximum size of the buffer. If the buffer size exceeds this value, Mule raises a STREAM_MAXIMUM_SIZE_EXCEEDED error. A value of less than or equal to 0 means no limit.

Buffer Unit

Enumeration, one of:

  • BYTE

  • KB

  • MB

  • GB

Unit for the Initial Buffer Size, Buffer Size Increment, and Buffer Unit fields.

### Repeatable File Store Stream Configures the repeatable file-store streaming strategy by which Mule keeps a portion of the stream content in memory. If the stream content is larger than the configured buffer size, Mule backs up the buffer’s content to disk and then clears the memory.
FieldTypeDescriptionDefault ValueRequired

In Memory Size

Number

Maximum amount of memory that the stream can use for data. If the amount of memory exceeds this value, Mule buffers the content to disk. To optimize performance:

  • Configure a larger buffer size to avoid the number of times Mule needs to write the buffer on disk. This increases performance, but it also limits the number of concurrent requests your application can process, because it requires additional memory.

  • Configure a smaller buffer size to decrease memory load at the expense of response time.

Buffer Unit

Enumeration, one of:

  • BYTE

  • KB

  • MB

  • GB

Unit for the In Memory Size field.

### Error Mapping
FieldTypeDescriptionDefault ValueRequired

Source

Enumeration, one of:

  • ANY

  • REDELIVERY_EXHAUSTED

  • TRANSFORMATION

  • EXPRESSION

  • SECURITY

  • CLIENT_SECURITY

  • SERVER_SECURITY

  • ROUTING

  • CONNECTIVITY

  • RETRY_EXHAUSTED

  • TIMEOUT

Target

String

x

### Pgp Key Selection
FieldTypeDescriptionDefault ValueRequired

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

### Pgp Asymmetric Key Info
FieldTypeDescriptionDefault ValueRequired

Key Id

String

Internal key ID for referencing from operations.

x

Key Pair Identifier

A way to identify the key inside the keystore.

x

Passphrase

String

The password for unlocking the secret part of the key.

### Pgp Asymmetric Key Identifier
FieldTypeDescriptionDefault ValueRequired

Fingerprint

String

Principal

String

### Jce Asymmetric Key Info
FieldTypeDescriptionDefault ValueRequired

Key Id

String

Internal key ID for referencing from operations.

x

Alias

String

Alias of the key in the keystore.

x

Password

String

Password used to unlock the private part of the key.

### Jce Symmetric Key Info
FieldTypeDescriptionDefault ValueRequired

Key Id

String

Internal key ID for referencing from operations.

x

Alias

String

Alias of the key in the keystore.

x

Password

String

Password used to unlock the key.

x

--- product: Cryptography Module version: 2.2 is-latest-version: true --- # Cryptography Module Reference 2.2 > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Cryptography Module provides cryptography capabilities to a Mule application. ## Configurations --- ### Jce JCE configuration for Java keystores and inline keys. #### Parameters
NameTypeDescriptionDefault ValueRequired

Name

String

Name for this configuration. Connectors reference the configuration with this name.

x

Keystore

String

Path to the keystore file.

Type

Enumeration, one of:

  • JKS

  • JCEKS

  • PKCS12

  • BCFKS

Type of the keystore.

x

Password

String

Password for unlocking the keystore.

Jce Key Infos

List of keys to be considered, with internal IDs for referencing them.

Use random IVs

Boolean

Use random initial vectors (IVs) for CBC algorithms. In case of decryption, it assumes IV is prepended on the ciphertext.

false

Name

String

ID used to reference this configuration.

x

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

## Supported Operations - [Jce Decrypt](#JceDecrypt) - [Jce Encrypt](#JceEncrypt) - [Jce Sign](#JceSign) - [Jce Validate](#JceValidate) - [Pgp Decrypt](#PgpDecrypt) - [Pgp Encrypt](#PgpEncrypt) - [Pgp Encrypt And Sign](#PgpEncryptAndSign) - [Pgp Encrypt Binary](#PgpEncryptBinary) - [Pgp Sign](#PgpSign) - [Pgp Sign Binary](#PgpSignBinary) - [Pgp Validate](#PgpValidate) - [Xml Decrypt](#XmlDecrypt) - [Xml Encrypt](#XmlEncrypt) - [Xml Sign](#XmlSign) - [Xml Validate](#XmlValidate) - [Calculate Checksum](#CalculateChecksum) - [Validate Checksum](#ValidateChecksum) --- ### Pgp Keystore configuration for GPG. Contains a list of keys with internal names to use in the operations. #### Parameters
NameTypeDescriptionDefault ValueRequired

Name

String

Name for this configuration. Connectors reference the configuration with this name.

x

Public Keyring

String

Public key ring file.

Private Keyring

String

Private key ring file.

Pgp Key Infos

Array of One of:

List of keys to be considered, with internal IDs for referencing them.

Name

String

ID used to reference this configuration.

x

Expiration Policy

Configures the minimum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

## Operations ## Jce Decrypt `` Decrypt a stream using JCE, with a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to decrypt

#[payload]

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Cipher

String

A raw cipher string in the form "algorithm/mode/padding" according to the Java crypto documentation, for example AES/CBC/PKCS5Padding. Note that GCM mode is currently not supported, and not all algorithm/mode/padding combinations are valid.

Algorithm

Enumeration, one of:

  • AES

  • AESWrap

  • ARCFOUR

  • Blowfish

  • DES

  • DESede

  • RC2

  • DESedeWrap

  • RSA

Algorithm from a list of valid definitions, this is preferred.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE ## Jce Encrypt `` Encrypt a stream using JCE, with a key. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Cipher

String

A raw cipher string in the form "algorithm/mode/padding" according to the Java crypto documentation, for example AES/CBC/PKCS5Padding. Note that GCM mode is currently not supported, and not all algorithm/mode/padding combinations are valid.

Algorithm

Enumeration, one of:

  • AES

  • AESWrap

  • ARCFOUR

  • Blowfish

  • DES

  • DESede

  • RC2

  • DESedeWrap

  • RSA

Algorithm from a list of valid definitions, this is preferred.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS ## Jce Sign `` Sign a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to sign

#[payload]

Algorithm

Enumeration, one of:

  • MD2withRSA

  • MD5withRSA

  • SHA1withRSA

  • SHA224withRSA

  • SHA256withRSA

  • SHA384withRSA

  • SHA512withRSA

  • NONEwithDSA

  • SHA1withDSA

  • SHA224withDSA

  • SHA256withDSA

  • HmacMD5

  • HmacSHA1

  • HmacSHA224

  • HmacSHA256

  • HmacSHA384

  • HmacSHA512

the algorithm used for signing

HmacSHA256

Output Mime Type

String

The mime type of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

String

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Jce Validate `` Validate a stream against a signature, using a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Value

Any

the message to authenticate

#[payload]

Expected

String

the signature to validate

x

Algorithm

Enumeration, one of:

  • MD2withRSA

  • MD5withRSA

  • SHA1withRSA

  • SHA224withRSA

  • SHA256withRSA

  • SHA384withRSA

  • SHA512withRSA

  • NONEwithDSA

  • SHA1withDSA

  • SHA224withDSA

  • SHA256withDSA

  • HmacMD5

  • HmacSHA1

  • HmacSHA224

  • HmacSHA256

  • HmacSHA384

  • HmacSHA512

the algorithm used for signing

HmacSHA256

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Error Mappings

Array of Error Mapping

Set of error mappings

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Xml Decrypt `` Decrypt the XML document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the document to decrypt

#[payload]

Element Path

String

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE ## Xml Encrypt `` Encrypt the XML document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the document to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • AES_CBC

  • AES_GCM

  • TRIPLEDES

the algorithm for encryption

AES_CBC

Element Path

String

the path to the element to encrypt, if empty the whole document is considered

Encrypt Content

Boolean

encrypt the XML element or its content, if false the whole XML element is encrypted.

true

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Encryption Algorithm

Enumeration, one of:

  • RSA15

  • RSA_OAEP

  • RSA_OAEP_11

RSA_OAEP

Canonicalization algorithm

Enumeration, one of:

  • EXCLUSIVE

  • EXCLUSIVE_WITH_COMMENTS

  • INCLUSIVE

  • INCLUSE_WITH_COMMENTS

EXCLUSIVE

Digest Algorithm

Enumeration, one of:

  • RIPEMD160

  • SHA1

  • SHA256

  • SHA512

SHA512

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS ## Xml Sign `` Sign an XML document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the XML document to sign

#[payload]

Digest Algorithm

Enumeration, one of:

  • RIPEMD160

  • SHA1

  • SHA256

  • SHA512

the hashing algorithm for signing

SHA256

Canonicalization Algorithm

Enumeration, one of:

  • EXCLUSIVE

  • EXCLUSIVE_WITH_COMMENTS

  • INCLUSIVE

  • INCLUSE_WITH_COMMENTS

the canonicalization method for whitespace and namespace unification

EXCLUSIVE

Type

Enumeration, one of:

  • DETACHED

  • ENVELOPED

  • ENVELOPING

the type of signature to create

ENVELOPED

Element Path

String

for internally detached signatures, an unambiguous XPath expression resolving to the element to sign

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Xml Validate `` Validate an XML signed document. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the document to verify (includes the signature)

#[payload]

Element Path

String

for internally detached signatures, an unambiguous XPath expression resolving to the signed element

Use Inline Certificate If Present

Boolean

Use inline defined certificate if found

false

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

x

Key Id

String

The key ID, as defined in the JCE configuration.

Jce Key Info

An inline key definition.

Error Mappings

Array of Error Mapping

Set of error mappings

### For Configurations - [Jce](#Jce) ### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Pgp Decrypt `` Decrypt a stream using PGP, giving the original data as a result. The decryption is done with the private key, so the secret passphrase must be provided. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to decrypt

#[payload]

File Name

String

the internal file name to decrypt, if not present the first will be used

Validate If Signature Found

Boolean

If the message being decrypted contains a signature, choose whether or not to validate the decrypted message against it

false

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PASSPHRASE ## Pgp Encrypt `` Encrypt a stream using PGP, giving an ASCII-armored stream output as a result. The encryption is done with the public key of the recipient, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • IDEA

  • TRIPLE_DES

  • CAST5

  • BLOWFISH

  • SAFER

  • DES

  • AES_128

  • AES_192

  • AES_256

  • TWOFISH

  • CAMELLIA_128

  • CAMELLIA_192

  • CAMELLIA_256

the symmetric algorithm to use for encryption

AES_256

File Name

String

the internal file name to use in the resulting PGP header

stream

Disable MDC

Boolean

If set, MDC (modification detection code) will not be used during encryption

false

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY ## Pgp Encrypt And Sign `` Encrypt a stream using PGP, giving an ASCII-armored stream output as a result. The encryption is done with the public key of the recipient, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • IDEA

  • TRIPLE_DES

  • CAST5

  • BLOWFISH

  • SAFER

  • DES

  • AES_128

  • AES_192

  • AES_256

  • TWOFISH

  • CAMELLIA_128

  • CAMELLIA_192

  • CAMELLIA_256

the symmetric algorithm to use for encryption

AES_256

File Name

String

the internal file name to use in the resulting PGP header

stream

Encryption Key Selection

the key used to encrypt the message.

x

Sign Key Selection

the key used to sign the message.

x

Disable MDC

Boolean

If set, MDC (modification detection code) will not be used during encryption

false

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY ## Pgp Encrypt Binary `` Encrypt a stream using PGP, giving a binary output as a result. The encryption is done with the public key of the recipient, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to encrypt

#[payload]

Algorithm

Enumeration, one of:

  • IDEA

  • TRIPLE_DES

  • CAST5

  • BLOWFISH

  • SAFER

  • DES

  • AES_128

  • AES_192

  • AES_256

  • TWOFISH

  • CAMELLIA_128

  • CAMELLIA_192

  • CAMELLIA_256

the symmetric algorithm to use for encryption

AES_256

File Name

String

the internal file name to use in the resulting PGP header

stream

Disable MDC

Boolean

If set, MDC (modification detection code) will not be used during encryption

false

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY ## Pgp Sign `` Create a detached (standalone) PGP signature of the stream. The signing is done with the private key of the sender, so the secret passphrase must be provided. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to sign

#[payload]

Algorithm

Enumeration, one of:

  • MD5

  • RIPEMD160

  • TIGER_192

  • HAVAL_5_160

  • DOUBLE_SHA

  • SHA1

  • SHA224

  • SHA256

  • SHA384

  • SHA512

the digest (or hashing) algorithm

SHA256

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Pgp Sign Binary `` Create a detached (standalone) PGP signature of the stream. The signing is done with the private key of the sender, so the secret passphrase must be provided. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Content

Any

the content to sign

#[payload]

Algorithm

Enumeration, one of:

  • MD5

  • RIPEMD160

  • TIGER_192

  • HAVAL_5_160

  • DOUBLE_SHA

  • SHA1

  • SHA224

  • SHA256

  • SHA384

  • SHA512

the digest (or hashing) algorithm

SHA256

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Pgp Validate `` Validate a PGP signature against a stream, to authenticate it. The validation is done with the public key of the sender, so the secret passphrase is not required. ### Parameters
NameTypeDescriptionDefault ValueRequired

Configuration

String

Name of the configuration to use.

x

Value

Any

the message to authenticate

#[payload]

Expected

Any

the signature

x

Config Ref

ConfigurationProvider

Name of the configuration to use to execute this component.

Error Mappings

Array of Error Mapping

Set of error mappings

### For Configurations - [Pgp](#Pgp) ### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Calculate Checksum `` Calculate the checksum of the stream. ### Parameters
NameTypeDescriptionDefault ValueRequired

Algorithm

Enumeration, one of:

  • CRC32

  • MD2

  • MD5

  • SHA_1

  • SHA_256

  • SHA_512

the checksum algorithm

SHA_512

Content

Any

the content for calculating the checksum

#[payload]

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

String

### Throws - CRYPTO:CHECKSUM ## Jce Decrypt Pbe `` Decrypt a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to decrypt

#[payload]

Algorithm

String

the algorithm for generating a key from the password

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding (FIPS)

Password

String

the password for decryption

x

Password Salt

String

Password salt used for encryption or decryption. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

0

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### Throws - CRYPTO:DECRYPTION - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE ## Jce Encrypt Pbe `` Encrypt a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to encrypt

#[payload]

Algorithm

String

the algorithm for generating a key from the password

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding

Password

String

the password for encryption

x

Password Salt

String

Password salt used for encryption or decryption. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

x

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

x

Output Mime Type

String

The mime type of the payload that this operation outputs.

Output Encoding

String

The encoding of the payload that this operation outputs.

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### Throws - CRYPTO:ENCRYPTION - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS ## Jce Sign Pbe `` Sign a stream using JCE, with a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to sign

#[payload]

Algorithm

String

the algorithm used for signing

PBKDF2withHmacSHA512

Password

String

the password used to sign

x

Password Salt

String

Password salt used for encryption or decryption. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

x

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

x

Output Mime Type

String

The mime type of the payload that this operation outputs.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

String

### Throws - CRYPTO:KEY - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:PASSPHRASE - CRYPTO:SIGNATURE ## Jce Validate Pbe `` Validate a stream against a signature, using a password. ### Parameters
NameTypeDescriptionDefault ValueRequired

Value

Any

the message to authenticate

#[payload]

Expected

String

the signature to validate

x

Algorithm

String

the algorithm used for signing

PBKDF2withHmacSHA512

Password

String

the password used to sign

x

Password Salt

String

Password salt used for encryption or decryption. Recommended minimum: 16 bytes of random data to ensure uniqueness and prevent rainbow table attacks. The salt is encoded in UTF-8 and cannot be modified after creation.

Iteration Count

Number

the iteration count used to sign. Recommended minimum: 100,000 iterations to slow down brute-force attacks in modern hardware.

0

Error Mappings

Array of Error Mapping

Set of error mappings

### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Pgp Binary To Armored `` Converts an encrypted PGP message or a PGP signature to an ASCII armored representation, suitable for plain text channels. ### Parameters
NameTypeDescriptionDefault ValueRequired

Content

Any

the content to convert

#[payload]

Streaming Strategy

Configures how Mule processes streams. Repeatable streams are the default behavior.

Target Variable

String

Name of the variable that storesoperation’s output will be placed

Target Value

String

An expression to evaluate against the operation’s output and store the expression outcome in the target variable

#[payload]

Error Mappings

Array of Error Mapping

Set of error mappings

### Output

Type

Any

### Throws - CRYPTO:PARAMETERS ## Validate Checksum `` Validate the checksum of the stream against an expected checksum. ### Parameters
NameTypeDescriptionDefault ValueRequired

Algorithm

Enumeration, one of:

  • CRC32

  • MD2

  • MD5

  • SHA_1

  • SHA_256

  • SHA_512

the checksum algorithm

SHA_512

Value

Any

the content for calculating the checksum

#[payload]

Expected

String

the expected checksum as an hexadecimal string

x

Error Mappings

Array of Error Mapping

Set of error mappings

### Throws - CRYPTO:MISSING\_KEY - CRYPTO:PARAMETERS - CRYPTO:VALIDATION ## Types ### Expiration Policy Configures an expiration policy strategy.
FieldTypeDescriptionDefault ValueRequired

Max Idle Time

Number

Configures the maximum amount of time that a dynamic configuration instance can remain idle before Mule considers it eligible for expiration.

Time Unit

Enumeration, one of:

  • NANOSECONDS

  • MICROSECONDS

  • MILLISECONDS

  • SECONDS

  • MINUTES

  • HOURS

  • DAYS

Time unit for the Max Idle Time field.

### Repeatable In Memory Stream Configures the in-memory streaming strategy by which the request fails if the data exceeds the MAX buffer size. Always run performance tests to find the optimal buffer size for your specific use case.
FieldTypeDescriptionDefault ValueRequired

Initial Buffer Size

Number

Initial amount of memory to allocate to the data stream. If the streamed data exceeds this value, the buffer expands by Buffer Size Increment, with an upper limit of Max In Memory Size value.

Buffer Size Increment

Number

This is by how much the buffer size expands if it exceeds its initial size. Setting a value of zero or lower means that the buffer should not expand, meaning that a STREAM_MAXIMUM_SIZE_EXCEEDED error is raised when the buffer gets full.

Max Buffer Size

Number

Maximum size of the buffer. If the buffer size exceeds this value, Mule raises a STREAM_MAXIMUM_SIZE_EXCEEDED error. A value of less than or equal to 0 means no limit.

Buffer Unit

Enumeration, one of:

  • BYTE

  • KB

  • MB

  • GB

Unit for the Initial Buffer Size, Buffer Size Increment, and Buffer Unit fields.

### Repeatable File Store Stream Configures the repeatable file-store streaming strategy by which Mule keeps a portion of the stream content in memory. If the stream content is larger than the configured buffer size, Mule backs up the buffer’s content to disk and then clears the memory.
FieldTypeDescriptionDefault ValueRequired

In Memory Size

Number

Maximum amount of memory that the stream can use for data. If the amount of memory exceeds this value, Mule buffers the content to disk. To optimize performance:

  • Configure a larger buffer size to avoid the number of times Mule needs to write the buffer on disk. This increases performance, but it also limits the number of concurrent requests your application can process, because it requires additional memory.

  • Configure a smaller buffer size to decrease memory load at the expense of response time.

Buffer Unit

Enumeration, one of:

  • BYTE

  • KB

  • MB

  • GB

Unit for the In Memory Size field.

### Error Mapping
FieldTypeDescriptionDefault ValueRequired

Source

Enumeration, one of:

  • ANY

  • REDELIVERY_EXHAUSTED

  • TRANSFORMATION

  • EXPRESSION

  • SECURITY

  • CLIENT_SECURITY

  • SERVER_SECURITY

  • ROUTING

  • CONNECTIVITY

  • RETRY_EXHAUSTED

  • TIMEOUT

Target

String

x

### Pgp Key Selection
FieldTypeDescriptionDefault ValueRequired

Key Id

String

The key ID, as defined in the JCE configuration.

Pgp Key Info

An inline key definition.

### Pgp Asymmetric Key Info
FieldTypeDescriptionDefault ValueRequired

Key Id

String

Internal key ID for referencing from operations.

x

Key Pair Identifier

A way to identify the key inside the keystore.

x

Passphrase

String

The password for unlocking the secret part of the key.

### Pgp Asymmetric Key Identifier
FieldTypeDescriptionDefault ValueRequired

Fingerprint

String

Principal

String

### Jce Asymmetric Key Info
FieldTypeDescriptionDefault ValueRequired

Key Id

String

Internal key ID for referencing from operations.

x

Alias

String

Alias of the key in the keystore.

x

Password

String

Password used to unlock the private part of the key.

### Jce Symmetric Key Info
FieldTypeDescriptionDefault ValueRequired

Key Id

String

Internal key ID for referencing from operations.

x

Alias

String

Alias of the key in the keystore.

x

Password

String

Password used to unlock the key.

x

--- product: Cryptography Module version: 2.0 --- # Cryptography Module XML and Maven Support > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Although you can manually code a Mule app in XML, it is more efficient to use Anypoint Studio. If you manually code a Mule runtime engine (Mule) app in XML, either from the Anypoint Studio XML editor or from a text editor, you can get access to the connector in your app by adding reference statements to both your XML Mule flow and the Apache Maven `pom.xml` file. When you add the connector in Studio, Studio automatically populates the XML code with the connector’s namespace and schema location. It also adds a dependency to the `pom.xml` file. ## Add a Namespace for the Connector Paste the following code inside the `` tag of the header of your configuration XML: ```xml http://www.mulesoft.org/schema/mule/cryptography http://www.mulesoft.org/schema/mule/cryptography/current/mule-cryptography.xsd ``` This example shows how the namespace statements are placed in the `` XML block: ```xml ``` ## Add a POM File Dependency The Apache Maven `pom.xml` file generated by Anypoint Studio contains dependencies for a Mule app. If you code a Mule app manually, include this XML snippet in your `pom.xml` file to enable access to this connector: ```xml com.mulesoft.modules mule-cryptography-module x.x.x mule-plugin ``` Replace `x.x.x` with the version that corresponds to the connector you are using. To obtain the most up-to-date `pom.xml` file information: 1. Go to [Anypoint Exchange](https://www.mulesoft.com/exchange/). 2. In Exchange, click **Login** and supply your Anypoint Platform username and password. 3. In Exchange, search for `cryptography`. 4. Select the connector. 5. Click **Dependency Snippets** near the upper right of the screen. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Salesforce Help Center](https://help.salesforce.com/s/?language=en_US) --- product: Cryptography Module version: 2.1 --- # Cryptography Module XML and Maven Support > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Although you can manually code a Mule app in XML, it is more efficient to use Anypoint Studio. If you manually code a Mule runtime engine (Mule) app in XML, either from the Anypoint Studio XML editor or from a text editor, you can get access to the connector in your app by adding reference statements to both your XML Mule flow and the Apache Maven `pom.xml` file. When you add the connector in Studio, Studio automatically populates the XML code with the connector’s namespace and schema location. It also adds a dependency to the `pom.xml` file. ## Add a Namespace for the Connector Paste the following code inside the `` tag of the header of your configuration XML: ```xml http://www.mulesoft.org/schema/mule/cryptography http://www.mulesoft.org/schema/mule/cryptography/current/mule-cryptography.xsd ``` This example shows how the namespace statements are placed in the `` XML block: ```xml ``` ## Add a POM File Dependency The Apache Maven `pom.xml` file generated by Anypoint Studio contains dependencies for a Mule app. If you code a Mule app manually, include this XML snippet in your `pom.xml` file to enable access to this connector: ```xml com.mulesoft.modules mule-cryptography-module x.x.x mule-plugin ``` Replace `x.x.x` with the version that corresponds to the connector you are using. To obtain the most up-to-date `pom.xml` file information: 1. Go to [Anypoint Exchange](https://www.mulesoft.com/exchange/). 2. In Exchange, click **Login** and supply your Anypoint Platform username and password. 3. In Exchange, search for `cryptography`. 4. Select the connector. 5. Click **Dependency Snippets** near the upper right of the screen. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Salesforce Help Center](https://help.salesforce.com/s/?language=en_US) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Cryptography Module XML and Maven Support > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Although you can manually code a Mule app in XML, it is more efficient to use Anypoint Studio. If you manually code a Mule runtime engine (Mule) app in XML, either from the Anypoint Studio XML editor or from a text editor, you can get access to the connector in your app by adding reference statements to both your XML Mule flow and the Apache Maven `pom.xml` file. When you add the connector in Studio, Studio automatically populates the XML code with the connector’s namespace and schema location. It also adds a dependency to the `pom.xml` file. ## Add a Namespace for the Connector Paste the following code inside the `` tag of the header of your configuration XML: ```xml http://www.mulesoft.org/schema/mule/cryptography http://www.mulesoft.org/schema/mule/cryptography/current/mule-cryptography.xsd ``` This example shows how the namespace statements are placed in the `` XML block: ```xml ``` ## Add a POM File Dependency The Apache Maven `pom.xml` file generated by Anypoint Studio contains dependencies for a Mule app. If you code a Mule app manually, include this XML snippet in your `pom.xml` file to enable access to this connector: ```xml com.mulesoft.modules mule-cryptography-module x.x.x mule-plugin ``` Replace `x.x.x` with the version that corresponds to the connector you are using. To obtain the most up-to-date `pom.xml` file information: 1. Go to [Anypoint Exchange](https://www.mulesoft.com/exchange/). 2. In Exchange, click **Login** and supply your Anypoint Platform username and password. 3. In Exchange, search for `cryptography`. 4. Select the connector. 5. Click **Dependency Snippets** near the upper right of the screen. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Salesforce Help Center](https://help.salesforce.com/s/?language=en_US) --- product: Cryptography Module version: 2.0 --- # Troubleshooting Cryptography Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To troubleshoot Cryptography Module, become familiar with app logs, PGP protocol, attached and detached signatures, and interpreting commonly thrown messages. ## View the App Log If you encounter problems while running your Mule runtime engine (Mule) app, you can view the app log as follows: - If you’re running the app from Anypoint Platform, the output is visible in the Anypoint Studio console window. - If you’re running the app using Mule from the command line, the app log is visible in your OS console. Unless the log file path is customized in the app’s log file `log4j2.xml`, view the app log in the default location `MULE_HOME/logs/.log`. ## Enable Cryptography Module Debug Logging To begin troubleshooting the Cryptography module, enable debug logging to see the exact error messages: 1. Access Anypoint Studio and navigate to the **Package Explorer** view. 2. Open your application by clicking the project name. 3. Open the `src/main/resources` path folder. 4. Open the `log4j2.xml` file inside the folder. 5. Add the following line: `` 6. Save your changes. 7. Click the project name in **Package Explorer** and then click **Run** > **Run As** > **Mule Application**. ## Understand PGP Encryption and Decryption Configuration During PGP encryption, the sender of the message must encrypt its content using the receiver’s _public key_. To encrypt messages in your Mule app using someone else’s public key, in the **Crypto Pgp** global configuration add the _receiver_ public keyring file in the **Public keyring** field. During PGP decryption, the receiver of the message must use its _private key_ to decrypt the contents of a message that was encrypted using a public key. To decrypt the message, in the **Crypto Pgp** global configuration add the _receiver_ private keyring file in the **Private keyring** field. ![Global element properties for Crypto PGP with keyring details](/mulesoft/current/en-us/cryptography-module/2.0/_images/mruntime-crypto-pgp-global-config.png) Figure 1. Crypto Pgp Global configuration with Public keyring and Private keyring fields ## Understand PGP Signature Configuration In addition to encrypting, you can sign a message. The signature provides an integrity check of the original message. To create a signature, in the **Crypto Pgp** global configuration add the _sender_ private keyring file in the **Private keyring** field. To validate a signature, in the **Crypto Pgp** global configuration add the _sender_ public keyring file in the **Public keyring** field. ### PGP Signature Types and Operations The Cryptography module has two PGP signature operations: - **Pgp sign**: Creates a PGP armored signature in ASCII format. - **Pgp sign binary**: Creates a PGP binary signature. In both cases, signing includes the private key of the sender, so the secret passphrase must be provided. There are two types of signatures: - Attached signature Generates a single document file that contains both the signature and the original document. - Detached signature Generates a single document file that contains only the signature, which is stored and transmitted separately from the document the signature signs. Currently, the Cryptography module supports validation of detached signatures only. ## Understand Common Throws Here is a list of common throw messages and how to interpret them: - CRYPTO:PARAMETERS The operation is configured using invalid parameters. - CRYPTO:MISSING\_KEY A key required for the operation was not found. - CRYPTO:PASSPHRASE The unlocking password is invalid. - CRYPTO:CHECKSUM An error occurred during an attempt to calculate a checksum. - CRYPTO:TRANSFORMATION An error occurred during an attempt to transform binary to ASCII to build the ASCII Armor file. - CRYPTO:VALIDATION The signature cannot be validated against the data. ## See Also - [Cryptography Module Reference](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference) - [Salesforce Help](https://help.salesforce.com) - [Known Issues](https://help.salesforce.com/s/issues) --- product: Cryptography Module version: 2.1 --- # Troubleshooting Cryptography Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To troubleshoot Cryptography Module, become familiar with app logs, PGP protocol, attached and detached signatures, and interpreting commonly thrown messages. ## View the App Log If you encounter problems while running your Mule runtime engine (Mule) app, you can view the app log as follows: - If you’re running the app from Anypoint Platform, the output is visible in the Anypoint Studio console window. - If you’re running the app using Mule from the command line, the app log is visible in your OS console. Unless the log file path is customized in the app’s log file `log4j2.xml`, view the app log in the default location `MULE_HOME/logs/.log`. ## Enable Cryptography Module Debug Logging To begin troubleshooting the Cryptography module, enable debug logging to see the exact error messages: 1. Access Anypoint Studio and navigate to the **Package Explorer** view. 2. Open your application by clicking the project name. 3. Open the `src/main/resources` path folder. 4. Open the `log4j2.xml` file inside the folder. 5. Add the following line: `` 6. Save your changes. 7. Click the project name in **Package Explorer** and then click **Run** > **Run As** > **Mule Application**. > [!NOTE] In FIPS-enabled environments, not all PGP operations are equally supported. Refer to > the Cryptography Module migration guide for a full FIPS support matrix by operation. ## Understand PGP Encryption and Decryption Configuration During PGP encryption, the sender of the message must encrypt its content using the receiver’s _public key_. To encrypt messages in your Mule app using someone else’s public key, in the **Crypto Pgp** global configuration add the _receiver_ public keyring file in the **Public keyring** field. During PGP decryption, the receiver of the message must use its _private key_ to decrypt the contents of a message that was encrypted using a public key. To decrypt the message, in the **Crypto Pgp** global configuration add the _receiver_ private keyring file in the **Private keyring** field. ![Global element properties for Crypto PGP with keyring details](/mulesoft/current/en-us/cryptography-module/2.1/_images/mruntime-crypto-pgp-global-config.png) Figure 1. Crypto Pgp Global configuration with Public keyring and Private keyring fields ## Understand PGP Signature Configuration In addition to encrypting, you can sign a message. The signature provides an integrity check of the original message. To create a signature, in the **Crypto Pgp** global configuration add the _sender_ private keyring file in the **Private keyring** field. To validate a signature, in the **Crypto Pgp** global configuration add the _sender_ public keyring file in the **Public keyring** field. ### PGP Signature Types and Operations The Cryptography module has two PGP signature operations: - **Pgp sign**: Creates a PGP armored signature in ASCII format. - **Pgp sign binary**: Creates a PGP binary signature. In both cases, signing includes the private key of the sender, so the secret passphrase must be provided. There are two types of signatures: - Attached signature Generates a single document file that contains both the signature and the original document. - Detached signature Generates a single document file that contains only the signature, which is stored and transmitted separately from the document the signature signs. Currently, the Cryptography module supports validation of detached signatures only. ## Troubleshoot RSA PKCS#1 v1.5 Encryption Disallowed Error The error `RSA PKCS#1 v1.5 encryption disallowed` applies to Cryptography Module 2.1.0 and later versions in FIPS-enabled environments. The PGP `Encrypt` operation triggers this error when attempting to use RSA PKCS#1 v1.5 for session key encryption. While the OpenPGP standard (RFC 4880) mandates this specific mechanism, FIPS-approved mode explicitly disallows it due to security constraints. Some key considerations: - PGP `Encrypt` operations are unsupported in FIPS mode because the mandated OpenPGP mechanism violates FIPS security constraints. - No configuration workarounds exist to enable PGP encryption within a FIPS boundary due to protocol-level limitations. - PGP `Decrypt` and `Validate` operations remain functional for legacy data as long as the underlying cryptographic material complies with FIPS standards. If your integration requires PGP encryption, you must perform the encryption step outside of the FIPS-compliant boundary. ## Understand Common Throws Here is a list of common throw messages and how to interpret them: - CRYPTO:PARAMETERS The operation is configured using invalid parameters. This typically occurs when: - Invalid algorithm names are provided - Invalid transformation strings are used - Required parameters are missing or have incorrect values - Element paths in XML operations are invalid or blank - CRYPTO:KEY General key-related problems. This is a parent error type that encompasses more specific key errors. - CRYPTO:MISSING\_KEY A key required for the operation was not found. This typically occurs when: - The specified key alias does not exist in the keystore - The keyId referenced in the operation is not configured - The keystore file cannot be found or loaded - The key identifier (fingerprint, principal, etc.) does not match any key in the keyring - CRYPTO:PASSPHRASE The unlocking password is invalid. This typically occurs when: - The password provided for a private key is incorrect - The keystore password is wrong - The passphrase for a PGP key is incorrect - CRYPTO:CHECKSUM An error occurred during an attempt to calculate a checksum. This typically occurs when: - The checksum algorithm is not supported - The input data is invalid or corrupted - There are issues with the underlying cryptographic provider - CRYPTO:ENCRYPTION An error occurred during an attempt to encrypt data. This typically occurs when: - The encryption algorithm is not supported or invalid - The key provided is not suitable for encryption - The key size is incompatible with the algorithm - The payload data is invalid or corrupted - Issues with the cryptographic provider configuration - CRYPTO:DECRYPTION An error occurred during an attempt to decrypt data. This typically occurs when: - The decryption algorithm does not match the encryption algorithm used - The key provided is incorrect or not suitable for decryption - The encrypted data is corrupted or invalid - The initialization vector (IV) is missing or incorrect - Issues with the cryptographic provider configuration - CRYPTO:TRANSFORMATION An error occurred during an attempt to transform binary to ASCII to build the ASCII Armor file. This typically occurs when: - Issues converting PGP binary data to armored format - Problems with Base64 encoding/decoding - Data corruption during transformation - CRYPTO:SIGNATURE An error occurred during an attempt to create a signature. This typically occurs when: - The signature algorithm is not supported or invalid - The key provided is not suitable for signing - The key is missing or not accessible - Issues with the cryptographic provider configuration - The key type does not match the signature algorithm requirements - CRYPTO:VALIDATION The signature cannot be validated against the data. This typically occurs when: - The signature is invalid or corrupted - The data has been modified after signing - The public key used for validation does not match the private key used for signing - The signature algorithm does not match - The certificate has expired or is not yet valid ## See Also - [Cryptography Module Reference](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference) - [Salesforce Help](https://help.salesforce.com) - [Known Issues](https://help.salesforce.com/s/issues) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Troubleshooting Cryptography Module > For the full documentation index, see: https://docs.mulesoft.com/llms.txt To troubleshoot Cryptography Module, become familiar with app logs, PGP protocol, attached and detached signatures, and interpreting commonly thrown messages. ## View the App Log If you encounter problems while running your Mule runtime engine (Mule) app, you can view the app log as follows: - If you’re running the app from Anypoint Platform, the output is visible in the Anypoint Studio console window. - If you’re running the app using Mule from the command line, the app log is visible in your OS console. Unless the log file path is customized in the app’s log file `log4j2.xml`, view the app log in the default location `MULE_HOME/logs/.log`. ## Enable Cryptography Module Debug Logging To begin troubleshooting the Cryptography module, enable debug logging to see the exact error messages: 1. Access Anypoint Studio and navigate to the **Package Explorer** view. 2. Open your application by clicking the project name. 3. Open the `src/main/resources` path folder. 4. Open the `log4j2.xml` file inside the folder. 5. Add the following line: `` 6. Save your changes. 7. Click the project name in **Package Explorer** and then click **Run** > **Run As** > **Mule Application**. > [!NOTE] In FIPS-enabled environments, not all PGP operations are equally supported. Refer to > the Cryptography Module migration guide for a full FIPS support matrix by operation. ## Understand PGP Encryption and Decryption Configuration During PGP encryption, the sender of the message must encrypt its content using the receiver’s _public key_. To encrypt messages in your Mule app using someone else’s public key, in the **Crypto Pgp** global configuration add the _receiver_ public keyring file in the **Public keyring** field. During PGP decryption, the receiver of the message must use its _private key_ to decrypt the contents of a message that was encrypted using a public key. To decrypt the message, in the **Crypto Pgp** global configuration add the _receiver_ private keyring file in the **Private keyring** field. ![Global element properties for Crypto PGP with keyring details](/mulesoft/current/en-us/cryptography-module/latest/_images/mruntime-crypto-pgp-global-config.png) Figure 1. Crypto Pgp Global configuration with Public keyring and Private keyring fields ## Understand PGP Signature Configuration In addition to encrypting, you can sign a message. The signature provides an integrity check of the original message. To create a signature, in the **Crypto Pgp** global configuration add the _sender_ private keyring file in the **Private keyring** field. To validate a signature, in the **Crypto Pgp** global configuration add the _sender_ public keyring file in the **Public keyring** field. ### PGP Signature Types and Operations The Cryptography module has two PGP signature operations: - **Pgp sign**: Creates a PGP armored signature in ASCII format. - **Pgp sign binary**: Creates a PGP binary signature. In both cases, signing includes the private key of the sender, so the secret passphrase must be provided. There are two types of signatures: - Attached signature Generates a single document file that contains both the signature and the original document. - Detached signature Generates a single document file that contains only the signature, which is stored and transmitted separately from the document the signature signs. Currently, the Cryptography module supports validation of detached signatures only. ## Troubleshoot RSA PKCS#1 v1.5 Encryption Disallowed Error The error `RSA PKCS#1 v1.5 encryption disallowed` applies to Cryptography Module 2.1.0 and later versions in FIPS-enabled environments. The PGP `Encrypt` operation triggers this error when attempting to use RSA PKCS#1 v1.5 for session key encryption. While the OpenPGP standard (RFC 4880) mandates this specific mechanism, FIPS-approved mode explicitly disallows it due to security constraints. Some key considerations: - PGP `Encrypt` operations are unsupported in FIPS mode because the mandated OpenPGP mechanism violates FIPS security constraints. - No configuration workarounds exist to enable PGP encryption within a FIPS boundary due to protocol-level limitations. - PGP `Decrypt` and `Validate` operations remain functional for legacy data as long as the underlying cryptographic material complies with FIPS standards. If your integration requires PGP encryption, you must perform the encryption step outside of the FIPS-compliant boundary. ## Understand Common Throws Here is a list of common throw messages and how to interpret them: - CRYPTO:PARAMETERS The operation is configured using invalid parameters. This typically occurs when: - Invalid algorithm names are provided - Invalid transformation strings are used - Required parameters are missing or have incorrect values - Element paths in XML operations are invalid or blank - CRYPTO:KEY General key-related problems. This is a parent error type that encompasses more specific key errors. - CRYPTO:MISSING\_KEY A key required for the operation was not found. This typically occurs when: - The specified key alias does not exist in the keystore - The keyId referenced in the operation is not configured - The keystore file cannot be found or loaded - The key identifier (fingerprint, principal, etc.) does not match any key in the keyring - CRYPTO:PASSPHRASE The unlocking password is invalid. This typically occurs when: - The password provided for a private key is incorrect - The keystore password is wrong - The passphrase for a PGP key is incorrect - CRYPTO:CHECKSUM An error occurred during an attempt to calculate a checksum. This typically occurs when: - The checksum algorithm is not supported - The input data is invalid or corrupted - There are issues with the underlying cryptographic provider - CRYPTO:ENCRYPTION An error occurred during an attempt to encrypt data. This typically occurs when: - The encryption algorithm is not supported or invalid - The key provided is not suitable for encryption - The key size is incompatible with the algorithm - The payload data is invalid or corrupted - Issues with the cryptographic provider configuration - CRYPTO:DECRYPTION An error occurred during an attempt to decrypt data. This typically occurs when: - The decryption algorithm does not match the encryption algorithm used - The key provided is incorrect or not suitable for decryption - The encrypted data is corrupted or invalid - The initialization vector (IV) is missing or incorrect - Issues with the cryptographic provider configuration - CRYPTO:TRANSFORMATION An error occurred during an attempt to transform binary to ASCII to build the ASCII Armor file. This typically occurs when: - Issues converting PGP binary data to armored format - Problems with Base64 encoding/decoding - Data corruption during transformation - CRYPTO:SIGNATURE An error occurred during an attempt to create a signature. This typically occurs when: - The signature algorithm is not supported or invalid - The key provided is not suitable for signing - The key is missing or not accessible - Issues with the cryptographic provider configuration - The key type does not match the signature algorithm requirements - CRYPTO:VALIDATION The signature cannot be validated against the data. This typically occurs when: - The signature is invalid or corrupted - The data has been modified after signing - The public key used for validation does not match the private key used for signing - The signature algorithm does not match - The certificate has expired or is not yet valid ## See Also - [Cryptography Module Reference](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference) - [Salesforce Help](https://help.salesforce.com) - [Known Issues](https://help.salesforce.com/s/issues) --- product: Cryptography Module version: 2.0 --- # Upgrading and Migrating Cryptography Module 2.0 > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Upgrade Cryptography Module to version 2.x.x. ## Supported Upgrade Paths
From VersionTo Version

1.3.x

2.0.0

## Changes in This Release This release contains these changes: - Changes to default values for connector operations - Migrating your PGP Keyring to AES-Encrypted keys when operating in FIPS mode - Using different key pairs for Sign, Encrypt, and Decrypt operations to enhance security - Using password-based encryption - Using BCFKS as the required keystore and truststore type - Specifying algorithms dynamically - Registering the XMLDSig Security Provider - Enabling compatibility for Decrypt or Validate operations without KDF parameters > [!NOTE] Every reference to Federal Information Processing Standards (FIPS) in this guide pertains > to FIPS version 140-2 or 140-3. The minimum supported Mule runtime engine version is 4.4.x to use Cryptography Module 2.0.0. Make sure compatibility with FIPS compliance and supported runtime environments. Upgrade your Mule runtime if you use an older version. ## Scope and Limitations (FIPS) The **PGP Encrypt** operation is not supported in FIPS environments due to a limitation in the OpenPGP standard (RFC 4880). OpenPGP mandates the use of RSAES-PKCS1-v1\_5 for session key encryption, which is explicitly disallowed in FIPS-approved mode. This limitation exists regardless of how the keyring is generated, whether with GPG 2.0 and lower, GPG 2.1 and higher, or BC-FIPS. The [Troubleshoot Key Protection Issues](#troubleshoot-key-protection-issues) section doesn’t work in FIPS environments because of this OpenPGP limitation with PGP Encrypt operations. ## Upgrade Steps Follow these steps to perform the upgrade: 1. In Anypoint Studio, create a Mule project. 2. In **Mule Palette**, click **Search in Exchange**. 3. In **Add Dependencies to Project**, enter `cryptography module` in the search field. 4. In **Available modules**, select **Cryptography Module** and click **Add**. 5. Click **Finish**. 6. Verify that the mule-cryptography-module\` dependency version is 2.0.0 in the `pom.xml` file in the Mule project. Studio upgrades the connector automatically. ## Post Upgrade Steps After upgrading Cryptography Module, the module no longer bundles security providers. If your environment already has the security providers (such as those in the MuleSoft Government Cloud environment), you must not do any additional configuration. The existing environment offers ‌the security providers. Otherwise, add the dependencies for either Bouncy Castle (BC) or Bouncy Castle FIPS (BCFIPS) to your Mule app project configuration by including them as [Additional Plugin Dependencies](https://docs.mulesoft.com/mule-runtime/latest/mmp-concept#configure-plugin-dependencies) or as [Shared Libraries](https://docs.mulesoft.com/mule-runtime/latest/mmp-concept#configure-shared-libraries) in your `pom.xml` file of your Mule app. This ensures the module has access to the required security providers for its operations. BCFIPS dependency: ```xml org.bouncycastle bc-fips ${bc-fips.version} org.bouncycastle bcpg-fips ${bcpg-fips.version} ``` BC dependency: ```xml org.bouncycastle bcpg-jdk18on ${bcpg.version} org.bouncycastle bcprov-jdk18on ${bcprov.version} ``` ### Using Bouncy Castle JDK 18 on Dependencies Version 1.80 Starting from Bouncy Castle version 1.80, the project version underwent a significant internal reorganization, which affects how you must include the libraries when using JDK18on artifacts, for example `bcprov-jdk18on`, `bcpg-jdk18on`. In prior versions to version 1.80, for example 1.79 or earlier, to enable full functionality for PGP operations and password-based encryption (PBE) features, it was sufficient to add only the `bcprov-jdk18on` or `bcpg-jdk18on` libraries. These additional libraries are mandatory because: - `bcpkix-jdk18on` contains essential cryptographic protocol classes, for example ASN.1 structures used in PGP operations. - `bcutil-jdk18on` includes utility classes that are now referenced by low-level operations in the other modules. If you don’t add these dependencies, you can encounter runtime errors such as: - java.lang.ClassNotFoundException: org.bouncycastle.bcpg.ArmoredOutputStream - java.lang.NoClassDefFoundError: org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers - java.lang.IllegalArgumentException: Attempt to override lookup strategy ParentFirstLookupStrategy for package: org.bouncycastle.asn1.nist Therefore, if you use BC version 1.80 or higher with Cryptography Module 2.0.0 in non-FIPS mode, make sure you include these libraries in your Mule app: - `bcprov-jdk18on` - `bcpg-jdk18on` - `bcpkix-jdk18on` - `Bcutil-jdk18on` If you prefer a FIPS-compliant environment, use the `bc-fips` and `bcpg-fips` libraries. Example of Mule Maven Plugin configuration for Cryptography Module using Bouncy Castle JDK 18 on Dependencies Version 1.80: ```xml org.mule.tools.maven mule-maven-plugin ${mule.maven.plugin.version} com.mulesoft.modules mule-cryptography-module org.bouncycastle bcprov-jdk18on 1.80 org.bouncycastle bcpg-jdk18on 1.80 org.bouncycastle bcpkix-jdk18on 1.80 org.bouncycastle bcutil-jdk18on 1.80 ``` ## Verify the Upgrade After you install the latest version of the module, verify the upgrade: 1. In Studio, verify that there are no errors in the **Problems** or **Console** views. 2. Verify that there are no problems in the project’s `pom.xml` file. 3. Test the connection to verify that the operations work. ## Reverting the Upgrade If you must revert to the previous version of Cryptography Module, go to Anypoint Studio and do the following: 1. In the project’s `pom.xml file`, change the `mule-cryptography-module` dependency version 2.0.0 to the previous version, and delete the dependencies used from the section. 2. Return to the **Execute** tab, and in the **Engine** section, select one of the default engines. 3. In the **Configuration XML** tab, confirm the selected engine name also changed. ## Changes to Default Values for Connector Operations To improve the security posture of the Cryptography Module, many default values for operations and configuration parameters are updated in version 2.0.0. These changes reflect the adoption of more secure algorithm stacks and modern cryptographic practices. When migrating from a previous version, declare the default values you relied on in version 1.x. This ensures compatibility and avoids unexpected results due to default value changes in the new version. This table provides the default values that changed in version 2.0.0:
Table 1. Default values summary table
ComponentDafault in version 1.xDafault in version 2.0.0

XML Signature Digest Algorithm

SHA1

SHA512

JCE PBE Signature Algorithm

PBEWithHmacSHA256

PBKDF2withHmacSHA512

JCE PBE Encryption/Decryption Algorithm

PBEWithHmacSHA256AndAES_128

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding

Checksum Algorithm

SHA_256

SHA_512

Keystore Type

JKS

None, must be explicitly provided; BCFKS required in FIPS.

## Migrate PGP Keyring to AES-Encrypted Keys for FIPS To ensure your Mule app adheres to FIPS when performing PGP operations, you must migrate your PGP keyrings to utilize Advanced Encryption Standard (AES) encryption. The default PGP key generation employs the CAST5 cipher, which isn’t FIPS-compliant. Using non-compliant ciphers can lead to runtime exceptions, such as `org.mule.runtime.api.exception.MuleRuntimeException` indicating issues with the signed content format and a failure in the signing operation. This exception can happen if the `InputStream` returned by the PGP operation is empty or corrupted. To achieve FIPS compliance for PGP signatures, follow this process: 1. Create keyrings and keys 2. Migrate keys to AES 3. Export secret and public keys 4. Configure the Cryptography Module to use the keyring ### Create Keyrings and Keys > [!NOTE] Create a backup of your keyrings and keys in case you must perform a rollback. To create a keyring from scratch, perform ‌these steps using GNU GPG: 1. Create a new keyring by running this command: ```xml gpg --no-default-keyring --keyring example.kbx --fingerprint gpg: keybox '/Users/youruser/.gnupg/example.kbx' created ``` 2. Save the new keybox location to use it later. 3. Create your PGP keys for signing or validating by running this command and following the instructions returned. (Select RSA as your cipher, because DSA isn’t FIPS-compliant.) ```xml gpg --no-default-keyring --keyring example.kbx --full-generate-key gpg (GnuPG/MacGPG2) 2.2.41; Copyright (C) 2022 g10 Code GmbH This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) (14) Existing key from card Your selection? 1 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (3072) 4096 Requested keysize is 4096 bits Please specify how long the key should be valid. 0 = key does not expire = key expires in n days w = key expires in n weeks m = key expires in n months y = key expires in n years Key is valid for? (0) 0 Key does not expire at all Is this correct? (y/N) y GnuPG needs to construct a user ID to identify your key. Real name: Test Name must be at least 5 characters long Real name: TestName Email address: test@example.com Comment: You selected this USER-ID: "TestName " Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. gpg: revocation certificate stored as '/Users/youruser/.gnupg/openpgp-revocs.d/991F7216B03C0B2B088AB20D5F46261934B56AF2.rev' public and secret key created and signed. pub rsa4096 2024-12-26 [SC] 991F7216B03C0B2B088AB20D5F46261934B56AF2 uid TestName sub rsa4096 2024-12-26 [E] ``` 4. List your keys to find out their fingerprints before migrating them to AES by running this command: ```xml gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --list-secret-keys --keyid-format=long --fingerprint /Users/youruser/.gnupg/example.kbx ----------------------------------- sec rsa4096/5F46261934B56AF2 2024-12-26 [SC] Key fingerprint = 991F 7216 B03C 0B2B 088A B20D 5F46 2619 34B5 6AF2 uid [ultimate] TestName ssb rsa4096/E7C647D222B1F1C1 2024-12-26 [E] ``` ### Migrate Keys to AES Migrate each key to AES with SHA256 to make them FIPS compliant: 1. Copy the key to migrate fingerprint. 2. Paste the key in this ‌command without spaces. Note that running this command enables a command line: ```xml gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --s2k-cipher-algo AES256 --s2k-digest-algo SHA256 --s2k-mode 3 --s2k-count 65000000 --edit-key [KEYID] ``` 3. Enter the passwd command to change the key password. You can use the same password. A prompt requires the current password first and then the new one: ```xml passwd ``` 4. Exit the gpg prompt by pressing Comand+C (macOS) or Ctrl+C on other operating systems. 5. Repeat this procedure for each of the listed keys in your keybox. #### Verify Key Protection After creating or migrating a key, validate that the expected protection algorithms, AES-256 and SHA-256 are correctly applied. Run this command to inspect the actual protection applied to the secret key: ```xml gpg --export-secret-keys [KEYID] | gpg --list-packets ``` 1. In the output, look for a line similar to: iter+salt S2K, algo: 9, SHA256 protection, hash: 8 Use this reference to interpret the values:
AlgorithmHash Function

  • algo: 9 → AES256

  • algo: 7 → AES128

  • hash: 8 → SHA256

  • hash: 2 → SHA1

If the output shows AES128 or SHA1, it means the protection wasn’t correctly applied, and the key isn’t FIPS-compliant. In that case, repeat the migration process or consider using the next alternative approach. Note that SHA1 protection can still appear in GPG output due to the v4 packet format, even when SHA256 is used for the hash algorithm. For example: iter+salt S2K, algo: 9, SHA1 protection, hash: 8 In this case, `algo: 9` indicates AES256 encryption and `hash: 8` indicates SHA256 hashing. The "SHA1 protection" text refers to the packet format version, not the actual hash algorithm used. ==== FIPS Support Matrix
OperationFIPS SupportNotes

PGP Encrypt

Not supported — blocked by BCFIPS since RSA PKCS#1 v1.5 encryption is disallowed.

OpenPGP limitation in FIPS environments

PGP Decrypt

Supported

For legacy data compatibility

PGP Sign

Supported

With AES256 and SHA256 protection

PGP Validate

Supported

For legacy data compatibility

PGP Encrypt remains unsupported in FIPS environments by design due to OpenPGP limitations. However, PGP Decrypt and Validate operations are supported for processing legacy data. ==== GPG Behavior by Version
GPG VersionKey Generation CommandOutput Behavior

GPG 2.0 and lower

--gen-key

Output correctly shows AES-256 cipher and SHA-256 hash, but secret key packet still displays "SHA1 protection" field

GPG 2.1 and higher

--full-generate-key

Output correctly shows AES-256 cipher and SHA-256 hash, but secret key packet still displays "SHA1 protection" field

For both GPG versions, the "SHA1 protection" field in the secret key packet refers to the packet format version, not the actual protection algorithms used. ### Export Secret and Public Key After migrating the keys to AES, export the secret and public keys: 1. Export the secret keys in a secret keyring to be used by the `mule-cryptography-module` module by running this command. This prompts you to enter the password for each of the secret keys in the keybox: ```xml gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --export-secret-keys > secring_example_aes.gpg ``` 1. Export the public keys if needed: ```xml gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --export > pubring_example_aes.gpg ``` ### Troubleshoot Key Protection Issues In some cases, even after executing: ```xml gpg --s2k-cipher-algo AES256 --s2k-digest-algo SHA256 --s2k-mode 3 --s2k-count 65000000 --edit-key [KEYID] ``` The key may still appear protected with AES128 and SHA1. This is due to a change introduced in GPG 2.1 and later: secret key protection is no longer managed directly by `gpg`, but by `gpg-agent`. In GPG 2.1 and later, `gpg` isn’t directly responsible for encrypting secret keys at rest, and options such as `--s2k-cipher-algo` have no effect. Instead, `gpg-agent` is solely responsible and it provides no interface to change the cipher or digest algorithms in use. In practice: - S2K parameters passed on the command line or stored in `gpg.conf` aren’t applied when generating or editing keys in GPG 2.1+. - `gpg-agent` uses internal defaults — typically AES128 and SHA1 — with no configuration interface to change them. #### Alternative: Programmatic Key Generation with Bouncy Castle If you want to make secret keys protected with certain algorithms, like AES256 and SHA256, use Java and Bouncy Castle to make them directly. This approach gives you full control over: - Encryption algorithm: AES-256 - Hash digest: SHA-256 - S2K mode: Iterated and Salted (mode 3) - Iteration count: e.g., 65,000,000 Example: ```xml new JcePBESecretKeyEncryptorBuilder(PGPEncryptedData.AES_256, sha256Calc) .setProvider("BC") .build(password.toCharArray()); ``` This method ensures FIPS-compliant protection and is suitable for automated or controlled environments. ### Configure the Cryptography Module to Use the Keyring Configure the Cryptography Module to use the generated keyring for signature and validation. 1. Copy the `secring_example.aes.gpg` and `pubring_example_aes.gpg` to your Mule project’s `src/main/resources` folder or to the ‌location inside your on-premises server. 2. Create a pop configuration like this to be used by the Cryptography Module PGP operations: ```xml ``` Notes for Cryptography Module PGP operations: - The fingerprint used for validation can be the complete value or the last 16 characters, as shown in the previous example. - The org.mule.runtime.api.exception.MuleRuntimeException may be thrown at runtime in FIPS environments if the sign operation fails to generate the signed content. This can occur if the InputStream is empty or corrupted, or if a non-compliant cipher is configured in the keyrings or generated PGP keys. Make sure your keyring and keys follow the guidelines in this migration guide. - DSA encryption isn’t allowed because DSA isn’t a FIPS-compliant cipher. - ECDSA or RSA PKCS v1.5 algorithms are no longer allowed for encryption in FIPS environments. If you use the PGP Encrypt operation with these algorithms, you can get these errors: - "RSA PKCS#1 v1.5 encryption disallowed" - "Can’t use ECDSA for encryption" - "ElGamal KeyFactory not available" - RSA encryption using PKCS#1 v1.5 is also disabled in FIPS mode. While you can reenable it using the system property `-Dorg.bouncycastle.rsa.allow_pkcs15_enc=true`, don’t enable it so you can maintain strict FIPS compliance. Enable it only if necessary and you understand the security implications. ## Use Different Key Pair for Sign, Encrypt, and Decrypt Operations If you use the same key pair, especially when using Bouncy Castle FIPS as a security provider or running your Mule app on MuleSoft Government Cloud, you can get this error: ```xml org.mule.runtime.api.component.execution.ComponentExecutionException: org.bouncycastle.crypto.IllegalKeyException: Attempt to sign/verify with RSA modulus already used for encrypt/decrypt ``` Therefore, use different key pairs for Sign, Encrypt, and Decrypt operations. ## Use Password-Based Encryption When using a FIPS-enabled environment, password-based encryption (PBE) algorithms starting with PBEWith are no longer supported because of security limits. For example: - `PBEWithSHA1AndRC2_40` - `PBEWithSHA1AndRC2_128` - `PBEWithSHA1AndRC4_128` - `PBEWithSHA1AndRC4_40` - `PBEWithMD5AndDES` - `PBEWithMD5AndTripleDES` - `PBEWithSHA1AndDESede` To ensure compliance, all password-based encryption implementations in FIPS mode follow these rules: - Your password must be at least 16 characters long. - A password SALT is mandatory for all PBE operations. This password must be at least 16 characters long. Furthermore, for enhanced security, you must change the password SALT for each configured operation. - For sign or validate, the default algorithm is PBKDF2withHmacSHA512. - For encrypt or decrypt, the default algorithm is PBKDF2withHmacSHA512_AES256_CBC\_\_PKCS5Padding - JCE PBE operations in FIPS environments require both a password SALT and an iteration count. You must update the module configurations to provide these values for all PBE operations. If you have data that was encrypted without a SALT and iteration count, you have these options: - Decrypt it outside of FIPS mode. - Temporarily enable the `com.mulesoft.crypto.allow-default-kdf-params` system property to decrypt it within FIPS, and then re-encrypt it using the new configuration. Also, in a FIPS environment, you must enable the `` com.mulesoft.crypto.allow-sun-pbe-in-fips` `` system property to allow the use of SUN algorithms. ## Specify Algorithms Dynamically Cryptography Module version 2.0.0 supports dynamic algorithm definitions, offering great flexibility by removing the dependency of a predefined list of available values shown in the value provider. You can specify dynamic algorithm definitions in two ways: - As a complete transformation string available in your environment’s registered security providers (for example `PBEWithHmacSHA256AndAES_128`, `PBEwithSHA1and3-KeyDESede`, and so on). - As a custom algorithm format introduced in version 2.0.0, which is detailed in the next section. > [!NOTE] Algorithms not present in your Mule runtime’s `Security.getProviders()` list result in > runtime errors. If needed, make sure you include the required cryptographic providers, for example > BouncyCastle FIPS, BC non-FIPS, in your Mule app’s classpath or security configuration. ### Use Custom Algorithm Format To enable better support for modern cryptographic configurations, especially in FIPS environments, Cryptography Module version 2.0.0 introduces a custom algorithm format that separates key derivation and encryption components. Format: `PBKDF2withHmac_AES___` Example: `PBKDF2withHmacSHA512_AES256_CBC__PKCS5Padding` This format: - Ensures full compatibility with FIPS-approved cryptographic profiles. - Provides explicit definition of key length, block mode, and padding. - Enables support for future extensions without requiring changes to the connector code or Studio configuration. You must define all four components. Defaults aren’t assumed. If a component is missing or malformed, ‌validation fails.
ComponentDescription

PBKDF2withHmac<digest>

Key derivation function (KDF) using HMAC + SHA512

AES<keyLength>

Cipher algorithm with key size (128, 192, 256)

mode

Cipher block mode (for example CBC, GCM)

padding

Padding scheme (for example PKCS5Padding, NoPadding)

Additionally, the default algorithm values are updated for stronger cryptographic guarantees:
OperationDefault value Cryptography Module version 1.xDefault value Cryptography Module version 2.x

Encrypt or Decrypt

PBEWithHmacSHA256AndAES_128

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding

Sign or Validate

PBEWithHmacSHA256

`PBKDF2withHmacSHA512

## Register the XMLDSig Security Provider Cryptographic operations involving XML signatures (for example XML Sign, XML Encrypt, XML Decrypt, and XML Validate) require the XMLDSig security provider (org.jcp.xml.dsig.internal.dom.XMLDSigRI), commonly provided by Apache Santuario. In FIPS-compliant environments, this provider might not be available or registered by default due to stricter security policies. To enable these XML-related cryptographic operations, the module can register the provider if you explicitly set this system property: `` -Dcom.mulesoft.connectors.allow-registration-of-xmldsig-provider-in-fips` `` This action registers the provider at the JVM level, making it globally available to all Mule apps running on the same JVM. Only use this setting if your Mule app explicitly requires XML signature or encryption support and the provider isn’t already present. ## Enable Compatibility for Decrypt or Validate Operations without KDF Parameters In Cryptography Module version 2.0, password-based encryption operations now enforce the configuration of both SALT and `iterationCount` parameters for enhanced security. To make sure your Mule app still decrypts or validates data that was encrypted or signed using Cryptography Module version 1.x, where SALT and `iterationCount` weren’t mandatory, activate these system properties: ```xml com.mulesoft.crypto.allow-default-kdf-params=true com.mulesoft.crypto.allow-sun-pbe-in-fips=true (only necessary when running in a FIPS-enabled environment) ``` Activating these system properties enables ‌compatibility mode under these conditions: - The operation is either Decrypt or Validate. - The encryption algorithm is based on Sun’s PBE schemes, for example, `PBEWithHmacSHA1AndAES_128`. - Neither SALT nor `iterationCount` parameters are explicitly provided (null or empty). If you provide a value for either SALT or `iterationCount` parameters, the module targets version 2.x compatibility and intentionally fails the operation to avoid inconsistent behavior. This compatibility mode is intended as a temporary solution to handle existing data. For all new data, make sure you configure both SALT and `iterationCount` as required by Cryptography Module version 2.x for optimal security and behavior. ## Use BCFKS as the Required Keystore and Truststore Type To enhance security compliance, the Bouncy Castle FIPS Keystore (BCFKS) type is mandatory for all Mule apps running in FIPS mode. You must migrate your existing Java KeyStore (JKS) or Public-Key Cryptography Standards #12 (PKCS12) keystores and truststores to BCFKS and update your mule-cryptography-module configurations to reference these new files: 1. Download Bouncy Castle FIPS Provider: ```xml curl -o $JAVA_HOME/jre/lib/ext/bc-fips-1.0.2.5.jar https://repo1.maven.org/maven2/org/bouncycastle/bc-fips/1.0.2.5/bc-fips-1.0.2.5.jar ``` 2. For JKS Keystores execute this keytool command, replacing `` with your current keystore password and adjusting the file paths accordingly: ```xml sudo /absolute/path/to/keytool_command/keytool -importkeystore -srckeystore /absolut/path/to/your/keystore/keystore.jks -srcstoretype JKS -srcstorepass changeit -destkeystore /absolute/path/to/new/keystore/keystore.bcfks -storepass -deststoretype BCFKS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath /absolut/path/to/bcfips-1.0.2.5.jar ``` For PKCS12 Keystores if your current keystore is in PKCS12 format, simply replace -srcstoretype JKS with -srcstoretype PKCS12 in the previous command. > [!NOTE] In FIPS environments, JKS can only store certificates and can’t hold private or secret > keys. JKS isn’t enabled by default in Bouncy Castle FIPS. To use JKS, enable it by setting the > system property: `` org.bouncycastle.jca.enable_jks=true` `` JKS is no longer the default keystore type. You must explicitly select the keystore type. In FIPS environments, BCFKS is required. ## See Also - [Cryptography Module Reference 2.0](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference) --- product: Cryptography Module version: 2.1 --- # Upgrading and Migrating Cryptography Module 2.x > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Upgrade Cryptography Module to version 2.x.x. ## Supported Upgrade Paths
From VersionTo Version

1.3.x

2.x

## Changes in This Release > [!IMPORTANT] FIPS Compatibility Notice for PGP Operations > PGP Encrypt is unsupported in FIPS environments because the OpenPGP standard (RFC 4880) mandates a > session key encryption mechanism that is strictly prohibited in FIPS-approved runtimes like > MuleSoft Government Cloud. > > The keyring migration steps in this guide are for operations such as PGP Sign/Validate and PGP > Decrypt for legacy data only, which does not enable PGP encryption functionality under FIPS. > > No FIPS-compliant configuration for PGP encryption exists for projects requiring the encryption of > new payloads while maintaining strict compliance. This release contains these changes: - Changes to default values for connector operations - Migrating your PGP keyrings to AES-encrypted secret keys for FIPS-compatible PGP operations (for example, Sign/Validate and legacy Decrypt scenarios) - Using different key pairs for PGP Sign and PGP Decrypt operations to enhance security and avoid key-usage restrictions in FIPS providers - Using password-based encryption - Using BCFKS as the required keystore and truststore type - Specifying algorithms dynamically - Registering the XMLDSig Security Provider - Enabling compatibility for Decrypt or Validate operations without KDF parameters > [!NOTE] Every reference to Federal Information Processing Standards (FIPS) in this guide pertains > to FIPS version 140-2 or 140-3. The minimum supported Mule runtime engine version is 4.4.x to use Cryptography Module 2.x. Make sure compatibility with FIPS compliance and supported runtime environments. Upgrade your Mule runtime if you use an older version. ## Scope and Limitations (FIPS) **PGP Encrypt** is not supported in FIPS environments because the OpenPGP standard (RFC 4880) mandates the use of RSAES-PKCS1-v1\_5, which is strictly prohibited in FIPS mode. This protocol-level limitation applies regardless of how you generate your keyring (GPG 2.0, GPG 2.1+, or BC-FIPS). Consequently: - You can’t encrypt new payloads using the PGP Encrypt operation while maintaining strict FIPS compliance. - You can still use PGP Sign/Validate and PGP Decrypt for legacy data, provided the underlying algorithms are FIPS-compliant and secret keys are AES-protected. The [Troubleshoot Key Protection Issues](#troubleshoot-key-protection-issues) section does not apply to enabling **PGP Encrypt** in FIPS environments. It only helps you diagnose key protection settings for operations that remain supported (for example, signing/validation and legacy decrypt scenarios). ## Upgrade Steps Follow these steps to perform the upgrade: 1. In Anypoint Studio, create a Mule project. 2. In **Mule Palette**, click **Search in Exchange**. 3. In **Add Dependencies to Project**, enter `cryptography module` in the search field. 4. In **Available modules**, select **Cryptography Module** and click **Add**. 5. Click **Finish**. 6. Verify that the `mule-cryptography-module` dependency version is 2.x in the `pom.xml` file in the Mule project. Studio upgrades the connector automatically. ## Post Upgrade Steps After upgrading Cryptography Module, the module no longer bundles security providers. If your environment already has the security providers (such as those in the MuleSoft Government Cloud environment), you must not do any additional configuration. The existing environment offers ‌the security providers. Otherwise, add the dependencies for either Bouncy Castle (BC) or Bouncy Castle FIPS (BCFIPS) to your Mule app project configuration by including them as [Additional Plugin Dependencies](https://docs.mulesoft.com/mule-runtime/latest/mmp-concept#configure-plugin-dependencies) or as [Shared Libraries](https://docs.mulesoft.com/mule-runtime/latest/mmp-concept#configure-shared-libraries) in your `pom.xml` file of your Mule app. This ensures the module has access to the required security providers for its operations. BCFIPS dependency: ```xml org.bouncycastle bc-fips ${bc-fips.version} org.bouncycastle bcpg-fips ${bcpg-fips.version} ``` BC dependency: ```xml org.bouncycastle bcpg-jdk18on ${bcpg.version} org.bouncycastle bcprov-jdk18on ${bcprov.version} org.bouncycastle bcpkix-jdk18on ${bcpkix.version} ``` > [!IMPORTANT] For PGP operations, you must include `bcpkix-jdk18on` (or `bcpkix-fips` for FIPS > environments) in addition to `bcpg-jdk18on` and `bcprov-jdk18on`. Without `bcpkix-jdk18on`, you > may encounter runtime errors such as: \* > `java.lang.ClassNotFoundException: org.bouncycastle.openpgp.PGPPublicKey` \* > `java.lang.NoClassDefFoundError: org.bouncycastle.openpgp.PGPSecretKey` > > The `bcpkix-jdk18on` library contains essential classes for PGP key handling and cryptographic > protocol structures. ### Using Bouncy Castle JDK 18 on Dependencies Version 1.80 Starting from Bouncy Castle version 1.80, the project version underwent a significant internal reorganization, which affects how you must include the libraries when using JDK18on artifacts, for example `bcprov-jdk18on`, `bcpg-jdk18on`. In prior versions to version 1.80, for example 1.79 or earlier, to enable full functionality for PGP operations and password-based encryption (PBE) features, it was sufficient to add only the `bcprov-jdk18on` or `bcpg-jdk18on` libraries. These additional libraries are mandatory because: - `bcpkix-jdk18on` contains essential cryptographic protocol classes, for example ASN.1 structures used in PGP operations. - `bcutil-jdk18on` includes utility classes that are now referenced by low-level operations in the other modules. If you don’t add these dependencies, you can encounter runtime errors such as: - java.lang.ClassNotFoundException: org.bouncycastle.bcpg.ArmoredOutputStream - java.lang.NoClassDefFoundError: org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers - java.lang.IllegalArgumentException: Attempt to override lookup strategy ParentFirstLookupStrategy for package: org.bouncycastle.asn1.nist Therefore, if you use BC version 1.80 or higher with Cryptography Module 2.x in non-FIPS mode, make sure you include these libraries in your Mule app: - `bcprov-jdk18on` - `bcpg-jdk18on` - `bcpkix-jdk18on` - `bcutil-jdk18on` If you prefer a FIPS-compliant environment, use the `bc-fips` and `bcpg-fips` libraries. Example of Mule Maven Plugin configuration for Cryptography Module using Bouncy Castle JDK 18 on Dependencies Version 1.80: ```xml org.mule.tools.maven mule-maven-plugin ${mule.maven.plugin.version} com.mulesoft.modules mule-cryptography-module org.bouncycastle bcprov-jdk18on 1.80 org.bouncycastle bcpg-jdk18on 1.80 org.bouncycastle bcpkix-jdk18on 1.80 org.bouncycastle bcutil-jdk18on 1.80 ``` ## Verify the Upgrade After you install the latest version of the module, verify the upgrade: 1. In Studio, verify that there are no errors in the **Problems** or **Console** views. 2. Verify that there are no problems in the project’s `pom.xml` file. 3. Test the connection to verify that the operations work. ## Reverting the Upgrade If you must revert to the previous version of Cryptography Module, go to Anypoint Studio and do the following: 1. In the project’s `pom.xml file`, change the `mule-cryptography-module` dependency version 2.1.0 to the previous version, and delete the dependencies used from the section. 2. Return to the **Execute** tab, and in the **Engine** section, select one of the default engines. 3. In the **Configuration XML** tab, confirm the selected engine name also changed. ## Changes to Default Values for Connector Operations To improve the security posture of the Cryptography Module, many default values for operations and configuration parameters are updated in version 2.x. These changes reflect the adoption of more secure algorithm stacks and modern cryptographic practices. When migrating from a previous version, declare the default values you relied on in version 1.x. This ensures compatibility and avoids unexpected results due to default value changes in the new version. This table provides the default values that changed in version 2.x:
Table 1. Default values summary table
ComponentDefault in version 1.xDefault in version 2.x

XML Signature Digest Algorithm

SHA1

SHA512

JCE PBE Signature Algorithm

PBEWithHmacSHA256

PBKDF2withHmacSHA512

JCE PBE Encryption/Decryption Algorithm

PBEWithHmacSHA256AndAES_128

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding

Checksum Algorithm

SHA_256

SHA_512

Keystore Type

JKS

None, must be explicitly provided; BCFKS required in FIPS.

## Migrate PGP Keyring to AES-Encrypted Keys for FIPS To ensure your Mule app adheres to FIPS when performing PGP operations, you must migrate your PGP keyrings to utilize Advanced Encryption Standard (AES) encryption. The default PGP key generation employs the CAST5 cipher, which isn’t FIPS-compliant. Using non-compliant ciphers can lead to runtime exceptions, such as `org.mule.runtime.api.exception.MuleRuntimeException` indicating issues with the signed content format and a failure in the signing operation. This exception can happen if the `InputStream` returned by the PGP operation is empty or corrupted. To achieve FIPS compliance for PGP signatures, follow this process: 1. Create keyrings and keys 2. Migrate keys to AES 3. Export secret and public keys 4. Configure the Cryptography Module to use the keyring ### Create Keyrings and Keys > [!NOTE] Create a backup of your keyrings and keys in case you must perform a rollback. To create a keyring from scratch, perform ‌these steps using GNU GPG: 1. Create a new keyring by running this command: ```xml gpg --no-default-keyring --keyring example.kbx --fingerprint gpg: keybox '/Users/youruser/.gnupg/example.kbx' created ``` 2. Save the new keybox location to use it later. 3. Create your PGP keys for signing or validating by running this command and following the instructions returned. (Select RSA as your cipher, because DSA isn’t FIPS-compliant.) **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --full-generate-key ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring example.kbx --full-generate-key gpg (GnuPG/MacGPG2) 2.2.41; Copyright (C) 2022 g10 Code GmbH This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) (14) Existing key from card Your selection? 1 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (3072) 4096 Requested keysize is 4096 bits Please specify how long the key should be valid. 0 = key does not expire = key expires in n days w = key expires in n weeks m = key expires in n months y = key expires in n years Key is valid for? (0) 0 Key does not expire at all Is this correct? (y/N) y GnuPG needs to construct a user ID to identify your key. Real name: Test Name must be at least 5 characters long Real name: TestName Email address: test@example.com Comment: You selected this USER-ID: "TestName " Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. gpg: revocation certificate stored as '/Users/youruser/.gnupg/openpgp-revocs.d/991F7216B03C0B2B088AB20D5F46261934B56AF2.rev' public and secret key created and signed. pub rsa4096 2024-12-26 [SC] 991F7216B03C0B2B088AB20D5F46261934B56AF2 uid TestName sub rsa4096 2024-12-26 [E] ``` 4. List your keys to find out their fingerprints before migrating them to AES by running this command: **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --list-secret-keys --keyid-format=long --fingerprint C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --------------------------------------------------- sec rsa4096/5F46261934B56AF2 2024-12-26 [SC] Key fingerprint = 991F 7216 B03C 0B2B 088A B20D 5F46 2619 34B5 6AF2 uid [ultimate] TestName ssb rsa4096/E7C647D222B1F1C1 2024-12-26 [E] ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --list-secret-keys --keyid-format=long --fingerprint /Users/youruser/.gnupg/example.kbx ----------------------------------- sec rsa4096/5F46261934B56AF2 2024-12-26 [SC] Key fingerprint = 991F 7216 B03C 0B2B 088A B20D 5F46 2619 34B5 6AF2 uid [ultimate] TestName ssb rsa4096/E7C647D222B1F1C1 2024-12-26 [E] ``` ### Migrate Keys to AES > [!WARNING] This migration process may not work reliably with GPG 2.1 and later versions due to > `gpg-agent` limitations. If the migration fails, use the > [programmatic Bouncy Castle approach](#alternative-programmatic-key-generation) instead. Migrate each key to AES with SHA256 to make them FIPS compliant: 1. Copy the key to migrate fingerprint. 2. Paste the key in this ‌command without spaces. Note that running this command enables a command line: **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --s2k-cipher-algo AES256 --s2k-digest-algo SHA256 --s2k-mode 3 --s2k-count 65000000 --edit-key [KEYID] ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --s2k-cipher-algo AES256 --s2k-digest-algo SHA256 --s2k-mode 3 --s2k-count 65000000 --edit-key [KEYID] ``` 3. Enter the passwd command to change the key password. You can use the same password. A prompt requires the current password first and then the new one: ```bash passwd ``` 4. Exit the gpg prompt: - On Windows: Press `Ctrl+C` - On macOS: Press `Command+C` - On Linux: Press `Ctrl+C` 5. Repeat this procedure for each of the listed keys in your keybox. #### Verify Key Protection After creating or migrating a key, validate that the expected protection algorithms, AES-256 and SHA-256 are correctly applied. Run this command to inspect the actual protection applied to the secret key: ```xml gpg --export-secret-keys [KEYID] | gpg --list-packets ``` 1. In the output, look for a line similar to: iter+salt S2K, algo: 9, SHA256 protection, hash: 8 Use this reference to interpret the values:
AlgorithmHash Function

  • algo: 9 → AES256

  • algo: 7 → AES128

  • hash: 8 → SHA256

  • hash: 2 → SHA1

If the output shows AES128 or SHA1, it means the protection wasn’t correctly applied, and the key isn’t FIPS-compliant. In that case, repeat the migration process or consider using the next alternative approach. Note that SHA1 protection can still appear in GPG output due to the v4 packet format, even when SHA256 is used for the hash algorithm. For example: iter+salt S2K, algo: 9, SHA1 protection, hash: 8 In this case, `algo: 9` indicates AES256 encryption and `hash: 8` indicates SHA256 hashing. The "SHA1 protection" text refers to the packet format version, not the actual hash algorithm used. ==== FIPS Support Matrix
OperationFIPS SupportNotes

PGP Encrypt

Not supported — blocked by BCFIPS since RSA PKCS#1 v1.5 encryption is disallowed.

OpenPGP limitation in FIPS environments

PGP Decrypt

Supported

For legacy data compatibility

PGP Sign

Supported

With AES256 and SHA256 protection

PGP Validate

Supported

For legacy data compatibility

PGP Encrypt remains unsupported in FIPS environments by design due to OpenPGP limitations. However, PGP Decrypt and Validate operations are supported for processing legacy data. ==== GPG Behavior by Version
GPG VersionKey Generation CommandOutput Behavior

GPG 2.0 and lower

--gen-key

Output correctly shows AES-256 cipher and SHA-256 hash, but secret key packet still displays "SHA1 protection" field

GPG 2.1 and higher

--full-generate-key

Output correctly shows AES-256 cipher and SHA-256 hash, but secret key packet still displays "SHA1 protection" field

For both GPG versions, the "SHA1 protection" field in the secret key packet refers to the packet format version, not the actual protection algorithms used. ### Export Secret and Public Key After migrating the keys to AES (or generating them programmatically), export the secret and public keys: 1. Export the secret keys in a secret keyring to be used by the `mule-cryptography-module` module by running this command. This prompts you to enter the password for each of the secret keys in the keybox: **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --export-secret-keys > secring_example_aes.gpg ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --export-secret-keys > secring_example_aes.gpg ``` 1. Export the public keys if needed: **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --export > pubring_example_aes.gpg ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --export > pubring_example_aes.gpg ``` ### Troubleshoot Key Protection Issues In some cases, even after executing: ```xml gpg --s2k-cipher-algo AES256 --s2k-digest-algo SHA256 --s2k-mode 3 --s2k-count 65000000 --edit-key [KEYID] ``` The key may still appear protected with AES128 and SHA1. This is due to a change introduced in GPG 2.1 and later: secret key protection is no longer managed directly by `gpg`, but by `gpg-agent`. In GPG 2.1 and later, `gpg` isn’t directly responsible for encrypting secret keys at rest, and options such as `--s2k-cipher-algo` have no effect. Instead, `gpg-agent` is solely responsible and it provides no interface to change the cipher or digest algorithms in use. In practice: - S2K parameters passed on the command line or stored in `gpg.conf` aren’t applied when generating or editing keys in GPG 2.1+. - `gpg-agent` uses internal defaults — typically AES128 and SHA1 — with no configuration interface to change them. #### Alternative: Programmatic Key Generation with Bouncy Castle If you want to make secret keys protected with certain algorithms, like AES256 and SHA256, use Java and Bouncy Castle to make them directly. This approach gives you full control over: - Encryption algorithm: AES-256 - Hash digest: SHA-256 - S2K mode: Iterated and Salted (mode 3) - Iteration count: e.g., 65,000,000 This method ensures FIPS-compliant protection and is suitable for automated or controlled environments. ##### Complete Java Example for Programmatic Key Generation Create a Java class to generate FIPS-compliant PGP keys. This example creates a complete key pair with proper AES-256 and SHA-256 protection: ```java import org.bouncycastle.bcpg.ArmoredOutputStream; import org.bouncycastle.bcpg.HashAlgorithmTags; import org.bouncycastle.bcpg.sig.Features; import org.bouncycastle.bcpg.sig.KeyFlags; import org.bouncycastle.crypto.generators.RSAKeyPairGenerator; import org.bouncycastle.crypto.params.RSAKeyGenerationParameters; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.openpgp.*; import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptorBuilder; import org.bouncycastle.openpgp.operator.PGPDigestCalculator; import org.bouncycastle.openpgp.operator.bc.BcPBESecretKeyEncryptorBuilder; import org.bouncycastle.openpgp.operator.bc.BcPGPContentSignerBuilder; import org.bouncycastle.openpgp.operator.bc.BcPGPDigestCalculatorProvider; import org.bouncycastle.openpgp.operator.bc.BcPGPKeyPair; import java.io.*; import java.math.BigInteger; import java.security.SecureRandom; import java.security.Security; import java.util.Date; public class PGPKeyGenerator { static { if (Security.getProvider("BC") == null) { Security.addProvider(new BouncyCastleProvider()); } } public static void generateKeyPair( String identity, String passphrase, String secretKeyringPath, String publicKeyringPath, int keySize) throws Exception { // Generate RSA key pair RSAKeyPairGenerator keyPairGenerator = new RSAKeyPairGenerator(); RSAKeyGenerationParameters keyGenParams = new RSAKeyGenerationParameters( BigInteger.valueOf(0x10001), new SecureRandom(), keySize, 12); keyPairGenerator.init(keyGenParams); // Create PGP key pair BcPGPKeyPair signingKeyPair = new BcPGPKeyPair( PGPPublicKey.RSA_SIGN, keyPairGenerator.generateKeyPair(), new Date()); BcPGPKeyPair encryptionKeyPair = new BcPGPKeyPair( PGPPublicKey.RSA_ENCRYPT, keyPairGenerator.generateKeyPair(), new Date()); // Create key ring generator PGPKeyRingGenerator keyRingGen = new PGPKeyRingGenerator( PGPSignature.POSITIVE_CERTIFICATION, signingKeyPair, identity, new BcPGPDigestCalculatorProvider().get(HashAlgorithmTags.SHA256), null, null, new BcPGPContentSignerBuilder( signingKeyPair.getPublicKey().getAlgorithm(), HashAlgorithmTags.SHA256), createKeyEncryptor(passphrase)); // Add encryption subkey keyRingGen.addSubKey(encryptionKeyPair); // Generate secret key ring PGPSecretKeyRing secretKeyRing = keyRingGen.generateSecretKeyRing(); try (FileOutputStream fos = new FileOutputStream(secretKeyringPath); ArmoredOutputStream aos = new ArmoredOutputStream(fos)) { secretKeyRing.encode(aos); } // Generate public key ring PGPPublicKeyRing publicKeyRing = keyRingGen.generatePublicKeyRing(); try (FileOutputStream fos = new FileOutputStream(publicKeyringPath); ArmoredOutputStream aos = new ArmoredOutputStream(fos)) { publicKeyRing.encode(aos); } } private static PBESecretKeyEncryptorBuilder createKeyEncryptor(String passphrase) { PGPDigestCalculator sha256Calc = new BcPGPDigestCalculatorProvider() .get(HashAlgorithmTags.SHA256); return new BcPBESecretKeyEncryptorBuilder( PGPEncryptedData.AES_256, sha256Calc) .setProvider("BC") .setIterationCount(65000000); } public static void main(String[] args) throws Exception { generateKeyPair( "TestName ", "your-secure-passphrase", "secring_example_aes.gpg", "pubring_example_aes.gpg", 4096); } } ``` ##### Maven Dependencies Required Add these dependencies to your `pom.xml` to compile and run the key generation code: ```xml org.bouncycastle bcpg-jdk18on 1.80 org.bouncycastle bcprov-jdk18on 1.80 org.bouncycastle bcpkix-jdk18on 1.80 org.bouncycastle bcutil-jdk18on 1.80 ``` ##### Compile and Run **On Windows:** ```cmd javac -cp "bcpg-jdk18on-1.80.jar;bcprov-jdk18on-1.80.jar;bcpkix-jdk18on-1.80.jar;bcutil-jdk18on-1.80.jar" PGPKeyGenerator.java java -cp ".;bcpg-jdk18on-1.80.jar;bcprov-jdk18on-1.80.jar;bcpkix-jdk18on-1.80.jar;bcutil-jdk18on-1.80.jar" PGPKeyGenerator ``` **On Linux/macOS:** ```bash javac -cp "bcpg-jdk18on-1.80.jar:bcprov-jdk18on-1.80.jar:bcpkix-jdk18on-1.80.jar:bcutil-jdk18on-1.80.jar" PGPKeyGenerator.java java -cp ".:bcpg-jdk18on-1.80.jar:bcprov-jdk18on-1.80.jar:bcpkix-jdk18on-1.80.jar:bcutil-jdk18on-1.80.jar" PGPKeyGenerator ``` This generates `secring_example_aes.gpg` and `pubring_example_aes.gpg` files with FIPS-compliant AES-256 and SHA-256 protection. ### Configure the Cryptography Module to Use the Keyring Configure the Cryptography Module to use the generated keyring for signature and validation. 1. Copy the `secring_example.aes.gpg` and `pubring_example_aes.gpg` to your Mule project’s `src/main/resources` folder or to the ‌location inside your on-premises server. 2. Create a pop configuration like this to be used by the Cryptography Module PGP operations: ```xml ``` Notes for Cryptography Module PGP operations: - The fingerprint used for validation can be the complete value or the last 16 characters, as shown in the previous example. - The org.mule.runtime.api.exception.MuleRuntimeException may be thrown at runtime in FIPS environments if the sign operation fails to generate the signed content. This can occur if the InputStream is empty or corrupted, or if a non-compliant cipher is configured in the keyrings or generated PGP keys. Make sure your keyring and keys follow the guidelines in this migration guide. - DSA encryption isn’t allowed because DSA isn’t a FIPS-compliant cipher. - ECDSA or RSA PKCS v1.5 algorithms are no longer allowed for encryption in FIPS environments. If you use the PGP Encrypt operation with these algorithms, you can get these errors: - "RSA PKCS#1 v1.5 encryption disallowed" - "Can’t use ECDSA for encryption" - "ElGamal KeyFactory not available" - RSA encryption using PKCS#1 v1.5 is also disabled in FIPS mode. While you can reenable it using the system property `-Dorg.bouncycastle.rsa.allow_pkcs15_enc=true`, don’t enable it so you can maintain strict FIPS compliance. Enable it only if necessary and you understand the security implications. ## Use Different Key Pair for Sign, Encrypt, and Decrypt Operations If you use the same key pair, especially when using Bouncy Castle FIPS as a security provider or running your Mule app on MuleSoft Government Cloud, you can get this error: ```xml org.mule.runtime.api.component.execution.ComponentExecutionException: org.bouncycastle.crypto.IllegalKeyException: Attempt to sign/verify with RSA modulus already used for encrypt/decrypt ``` Therefore, use different key pairs for Sign, Encrypt, and Decrypt operations. ## Use Password-Based Encryption When using a FIPS-enabled environment, password-based encryption (PBE) algorithms starting with PBEWith are no longer supported because of security limits. For example: - `PBEWithSHA1AndRC2_40` - `PBEWithSHA1AndRC2_128` - `PBEWithSHA1AndRC4_128` - `PBEWithSHA1AndRC4_40` - `PBEWithMD5AndDES` - `PBEWithMD5AndTripleDES` - `PBEWithSHA1AndDESede` To ensure compliance, all password-based encryption implementations in FIPS mode follow these rules: - Your password must be at least 16 characters long. - A password SALT is mandatory for all PBE operations. This password must be at least 16 characters long. Furthermore, for enhanced security, you must change the password SALT for each configured operation. - For sign or validate, the default algorithm is PBKDF2withHmacSHA512. - For encrypt or decrypt, the default algorithm is PBKDF2withHmacSHA512_AES256_CBC\_\_PKCS5Padding - JCE PBE operations in FIPS environments require both a password SALT and an iteration count. You must update the module configurations to provide these values for all PBE operations. If you have data that was encrypted without a SALT and iteration count, you have these options: - Decrypt it outside of FIPS mode. - Temporarily enable the `com.mulesoft.crypto.allow-default-kdf-params` system property to decrypt it within FIPS, and then re-encrypt it using the new configuration. Also, in a FIPS environment, you must enable the `` com.mulesoft.crypto.allow-sun-pbe-in-fips` `` system property to allow the use of SUN algorithms. ## Specify Algorithms Dynamically Cryptography Module version 2.1.0 supports dynamic algorithm definitions, offering great flexibility by removing the dependency of a predefined list of available values shown in the value provider. You can specify dynamic algorithm definitions in two ways: - As a complete transformation string available in your environment’s registered security providers (for example `PBEWithHmacSHA256AndAES_128`, `PBEwithSHA1and3-KeyDESede`, and so on). - As a custom algorithm format introduced in version 2.1.0, which is detailed in the next section. > [!NOTE] Algorithms not present in your Mule runtime’s `Security.getProviders()` list result in > runtime errors. If needed, make sure you include the required cryptographic providers, for example > BouncyCastle FIPS, BC non-FIPS, in your Mule app’s classpath or security configuration. ### Use Custom Algorithm Format To enable better support for modern cryptographic configurations, especially in FIPS environments, Cryptography Module version 2.1.0 introduces a custom algorithm format that separates key derivation and encryption components. Format: `PBKDF2withHmac_AES___` Example: `PBKDF2withHmacSHA512_AES256_CBC__PKCS5Padding` This format: - Ensures full compatibility with FIPS-approved cryptographic profiles. - Provides explicit definition of key length, block mode, and padding. - Enables support for future extensions without requiring changes to the connector code or Studio configuration. You must define all four components. Defaults aren’t assumed. If a component is missing or malformed, ‌validation fails.
ComponentDescription

PBKDF2withHmac<digest>

Key derivation function (KDF) using HMAC + SHA512

AES<keyLength>

Cipher algorithm with key size (128, 192, 256)

mode

Cipher block mode (for example CBC, GCM)

padding

Padding scheme (for example PKCS5Padding, NoPadding)

Additionally, the default algorithm values are updated for stronger cryptographic guarantees:
OperationDefault value Cryptography Module version 1.xDefault value Cryptography Module version 2.x

Encrypt or Decrypt

PBEWithHmacSHA256AndAES_128

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding

Sign or Validate

PBEWithHmacSHA256

`PBKDF2withHmacSHA512

## Register the XMLDSig Security Provider Cryptographic operations involving XML signatures (for example XML Sign, XML Encrypt, XML Decrypt, and XML Validate) require the XMLDSig security provider (org.jcp.xml.dsig.internal.dom.XMLDSigRI), commonly provided by Apache Santuario. In FIPS-compliant environments, this provider might not be available or registered by default due to stricter security policies. To enable these XML-related cryptographic operations, the module can register the provider if you explicitly set this system property: `` -Dcom.mulesoft.connectors.allow-registration-of-xmldsig-provider-in-fips` `` This action registers the provider at the JVM level, making it globally available to all Mule apps running on the same JVM. Only use this setting if your Mule app explicitly requires XML signature or encryption support and the provider isn’t already present. ## Enable Compatibility for Decrypt or Validate Operations without KDF Parameters In Cryptography Module version 2.1, password-based encryption operations now enforce the configuration of both SALT and `iterationCount` parameters for enhanced security. To make sure your Mule app still decrypts or validates data that was encrypted or signed using Cryptography Module version 1.x, where SALT and `iterationCount` weren’t mandatory, activate these system properties: ```xml com.mulesoft.crypto.allow-default-kdf-params=true com.mulesoft.crypto.allow-sun-pbe-in-fips=true (only necessary when running in a FIPS-enabled environment) ``` Activating these system properties enables ‌compatibility mode under these conditions: - The operation is either Decrypt or Validate. - The encryption algorithm is based on Sun’s PBE schemes, for example, `PBEWithHmacSHA1AndAES_128`. - Neither SALT nor `iterationCount` parameters are explicitly provided (null or empty). If you provide a value for either SALT or `iterationCount` parameters, the module targets version 2.x compatibility and intentionally fails the operation to avoid inconsistent behavior. This compatibility mode is intended as a temporary solution to handle existing data. For all new data, make sure you configure both SALT and `iterationCount` as required by Cryptography Module version 2.x for optimal security and behavior. ## Use BCFKS as the Required Keystore and Truststore Type To enhance security compliance, the Bouncy Castle FIPS Keystore (BCFKS) type is mandatory for all Mule apps running in FIPS mode. You must migrate your existing Java KeyStore (JKS) or Public-Key Cryptography Standards #12 (PKCS12) keystores and truststores to BCFKS and update your mule-cryptography-module configurations to reference these new files: 1. Download Bouncy Castle FIPS Provider: ```xml curl -o $JAVA_HOME/jre/lib/ext/bc-fips-1.0.2.5.jar https://repo1.maven.org/maven2/org/bouncycastle/bc-fips/1.0.2.5/bc-fips-1.0.2.5.jar ``` 2. For JKS Keystores execute this keytool command, replacing `` with your current keystore password and adjusting the file paths accordingly: ```xml sudo /absolute/path/to/keytool_command/keytool -importkeystore -srckeystore /absolut/path/to/your/keystore/keystore.jks -srcstoretype JKS -srcstorepass changeit -destkeystore /absolute/path/to/new/keystore/keystore.bcfks -storepass -deststoretype BCFKS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath /absolut/path/to/bcfips-1.0.2.5.jar ``` For PKCS12 Keystores if your current keystore is in PKCS12 format, simply replace -srcstoretype JKS with -srcstoretype PKCS12 in the previous command. > [!NOTE] In FIPS environments, JKS can only store certificates and can’t hold private or secret > keys. JKS isn’t enabled by default in Bouncy Castle FIPS. To use JKS, enable it by setting the > system property: `` org.bouncycastle.jca.enable_jks=true` `` JKS is no longer the default keystore type. You must explicitly select the keystore type. In FIPS environments, BCFKS is required. ## JCE Keystore Generation Example Use **JCE Encrypt** as an alternative to **PGP Encrypt** when operating in a FIPS environment. PGP Encrypt is not supported in FIPS environments because the OpenPGP standard (RFC 4880) mandates the use of RSAES-PKCS1-v1\_5, which is strictly prohibited in FIPS mode. For more information, refer to [Scope and Limitations (FIPS)](#scope-and-limitations-fips). To use JCE Encrypt in a FIPS environment, you must first generate a JCE keystore: 1. Download Bouncy Castle FIPS Provider: ```xml curl -o $JAVA_HOME/jre/lib/ext/bc-fips-1.0.2.5.jar https://repo1.maven.org/maven2/org/bouncycastle/bc-fips/1.0.2.5/bc-fips-1.0.2.5.jar ``` 2. Generate the keystore. In this example, you generate a BCFKS using the AES symmetric algorithm: ```xml keytool -genseckey -alias -keyalg AES -keysize 256 \ -keystore keystore.bcfks -storetype BCFKS \ -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \ -providerpath /absolute/path/to/bc-fips-1.0.2.5.jar ``` ## See Also - [Cryptography Module Reference 2.1](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Upgrading and Migrating Cryptography Module 2.x > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Upgrade Cryptography Module to version 2.x.x. ## Supported Upgrade Paths
From VersionTo Version

1.3.x

2.x

## Changes in This Release > [!IMPORTANT] FIPS Compatibility Notice for PGP Operations > PGP Encrypt is unsupported in FIPS environments because the OpenPGP standard (RFC 4880) mandates a > session key encryption mechanism that is strictly prohibited in FIPS-approved runtimes like > MuleSoft Government Cloud. > > The keyring migration steps in this guide are for operations such as PGP Sign/Validate and PGP > Decrypt for legacy data only, which does not enable PGP encryption functionality under FIPS. > > No FIPS-compliant configuration for PGP encryption exists for projects requiring the encryption of > new payloads while maintaining strict compliance. This release contains these changes: - Changes to default values for connector operations - Migrating your PGP keyrings to AES-encrypted secret keys for FIPS-compatible PGP operations (for example, Sign/Validate and legacy Decrypt scenarios) - Using different key pairs for PGP Sign and PGP Decrypt operations to enhance security and avoid key-usage restrictions in FIPS providers - Using password-based encryption - Using BCFKS as the required keystore and truststore type - Specifying algorithms dynamically - Registering the XMLDSig Security Provider - Enabling compatibility for Decrypt or Validate operations without KDF parameters > [!NOTE] Every reference to Federal Information Processing Standards (FIPS) in this guide pertains > to FIPS version 140-2 or 140-3. The minimum supported Mule runtime engine version is 4.4.x to use Cryptography Module 2.x. Make sure compatibility with FIPS compliance and supported runtime environments. Upgrade your Mule runtime if you use an older version. ## Scope and Limitations (FIPS) **PGP Encrypt** is not supported in FIPS environments because the OpenPGP standard (RFC 4880) mandates the use of RSAES-PKCS1-v1\_5, which is strictly prohibited in FIPS mode. This protocol-level limitation applies regardless of how you generate your keyring (GPG 2.0, GPG 2.1+, or BC-FIPS). Consequently: - You can’t encrypt new payloads using the PGP Encrypt operation while maintaining strict FIPS compliance. - You can still use PGP Sign/Validate and PGP Decrypt for legacy data, provided the underlying algorithms are FIPS-compliant and secret keys are AES-protected. The [Troubleshoot Key Protection Issues](#troubleshoot-key-protection-issues) section does not apply to enabling **PGP Encrypt** in FIPS environments. It only helps you diagnose key protection settings for operations that remain supported (for example, signing/validation and legacy decrypt scenarios). ## Upgrade Steps Follow these steps to perform the upgrade: 1. In Anypoint Studio, create a Mule project. 2. In **Mule Palette**, click **Search in Exchange**. 3. In **Add Dependencies to Project**, enter `cryptography module` in the search field. 4. In **Available modules**, select **Cryptography Module** and click **Add**. 5. Click **Finish**. 6. Verify that the `mule-cryptography-module` dependency version is 2.x in the `pom.xml` file in the Mule project. Studio upgrades the connector automatically. ## Post Upgrade Steps After upgrading Cryptography Module, the module no longer bundles security providers. If your environment already has the security providers (such as those in the MuleSoft Government Cloud environment), you must not do any additional configuration. The existing environment offers ‌the security providers. Otherwise, add the dependencies for either Bouncy Castle (BC) or Bouncy Castle FIPS (BCFIPS) to your Mule app project configuration by including them as [Additional Plugin Dependencies](https://docs.mulesoft.com/mule-runtime/latest/mmp-concept#configure-plugin-dependencies) or as [Shared Libraries](https://docs.mulesoft.com/mule-runtime/latest/mmp-concept#configure-shared-libraries) in your `pom.xml` file of your Mule app. This ensures the module has access to the required security providers for its operations. BCFIPS dependency: ```xml org.bouncycastle bc-fips ${bc-fips.version} org.bouncycastle bcpg-fips ${bcpg-fips.version} ``` BC dependency: ```xml org.bouncycastle bcpg-jdk18on ${bcpg.version} org.bouncycastle bcprov-jdk18on ${bcprov.version} org.bouncycastle bcpkix-jdk18on ${bcpkix.version} ``` > [!IMPORTANT] For PGP operations, you must include `bcpkix-jdk18on` (or `bcpkix-fips` for FIPS > environments) in addition to `bcpg-jdk18on` and `bcprov-jdk18on`. Without `bcpkix-jdk18on`, you > may encounter runtime errors such as: \* > `java.lang.ClassNotFoundException: org.bouncycastle.openpgp.PGPPublicKey` \* > `java.lang.NoClassDefFoundError: org.bouncycastle.openpgp.PGPSecretKey` > > The `bcpkix-jdk18on` library contains essential classes for PGP key handling and cryptographic > protocol structures. ### Using Bouncy Castle JDK 18 on Dependencies Version 1.80 Starting from Bouncy Castle version 1.80, the project version underwent a significant internal reorganization, which affects how you must include the libraries when using JDK18on artifacts, for example `bcprov-jdk18on`, `bcpg-jdk18on`. In prior versions to version 1.80, for example 1.79 or earlier, to enable full functionality for PGP operations and password-based encryption (PBE) features, it was sufficient to add only the `bcprov-jdk18on` or `bcpg-jdk18on` libraries. These additional libraries are mandatory because: - `bcpkix-jdk18on` contains essential cryptographic protocol classes, for example ASN.1 structures used in PGP operations. - `bcutil-jdk18on` includes utility classes that are now referenced by low-level operations in the other modules. If you don’t add these dependencies, you can encounter runtime errors such as: - java.lang.ClassNotFoundException: org.bouncycastle.bcpg.ArmoredOutputStream - java.lang.NoClassDefFoundError: org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers - java.lang.IllegalArgumentException: Attempt to override lookup strategy ParentFirstLookupStrategy for package: org.bouncycastle.asn1.nist Therefore, if you use BC version 1.80 or higher with Cryptography Module 2.x in non-FIPS mode, make sure you include these libraries in your Mule app: - `bcprov-jdk18on` - `bcpg-jdk18on` - `bcpkix-jdk18on` - `bcutil-jdk18on` If you prefer a FIPS-compliant environment, use the `bc-fips` and `bcpg-fips` libraries. Example of Mule Maven Plugin configuration for Cryptography Module using Bouncy Castle JDK 18 on Dependencies Version 1.80: ```xml org.mule.tools.maven mule-maven-plugin ${mule.maven.plugin.version} com.mulesoft.modules mule-cryptography-module org.bouncycastle bcprov-jdk18on 1.80 org.bouncycastle bcpg-jdk18on 1.80 org.bouncycastle bcpkix-jdk18on 1.80 org.bouncycastle bcutil-jdk18on 1.80 ``` ## Verify the Upgrade After you install the latest version of the module, verify the upgrade: 1. In Studio, verify that there are no errors in the **Problems** or **Console** views. 2. Verify that there are no problems in the project’s `pom.xml` file. 3. Test the connection to verify that the operations work. ## Reverting the Upgrade If you must revert to the previous version of Cryptography Module, go to Anypoint Studio and do the following: 1. In the project’s `pom.xml file`, change the `mule-cryptography-module` dependency version 2.1.0 to the previous version, and delete the dependencies used from the section. 2. Return to the **Execute** tab, and in the **Engine** section, select one of the default engines. 3. In the **Configuration XML** tab, confirm the selected engine name also changed. ## Changes to Default Values for Connector Operations To improve the security posture of the Cryptography Module, many default values for operations and configuration parameters are updated in version 2.x. These changes reflect the adoption of more secure algorithm stacks and modern cryptographic practices. When migrating from a previous version, declare the default values you relied on in version 1.x. This ensures compatibility and avoids unexpected results due to default value changes in the new version. This table provides the default values that changed in version 2.x:
Table 1. Default values summary table
ComponentDefault in version 1.xDefault in version 2.x

XML Signature Digest Algorithm

SHA1

SHA512

JCE PBE Signature Algorithm

PBEWithHmacSHA256

PBKDF2withHmacSHA512

JCE PBE Encryption/Decryption Algorithm

PBEWithHmacSHA256AndAES_128

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding

Checksum Algorithm

SHA_256

SHA_512

Keystore Type

JKS

None, must be explicitly provided; BCFKS required in FIPS.

## Migrate PGP Keyring to AES-Encrypted Keys for FIPS To ensure your Mule app adheres to FIPS when performing PGP operations, you must migrate your PGP keyrings to utilize Advanced Encryption Standard (AES) encryption. The default PGP key generation employs the CAST5 cipher, which isn’t FIPS-compliant. Using non-compliant ciphers can lead to runtime exceptions, such as `org.mule.runtime.api.exception.MuleRuntimeException` indicating issues with the signed content format and a failure in the signing operation. This exception can happen if the `InputStream` returned by the PGP operation is empty or corrupted. To achieve FIPS compliance for PGP signatures, follow this process: 1. Create keyrings and keys 2. Migrate keys to AES 3. Export secret and public keys 4. Configure the Cryptography Module to use the keyring ### Create Keyrings and Keys > [!NOTE] Create a backup of your keyrings and keys in case you must perform a rollback. To create a keyring from scratch, perform ‌these steps using GNU GPG: 1. Create a new keyring by running this command: ```xml gpg --no-default-keyring --keyring example.kbx --fingerprint gpg: keybox '/Users/youruser/.gnupg/example.kbx' created ``` 2. Save the new keybox location to use it later. 3. Create your PGP keys for signing or validating by running this command and following the instructions returned. (Select RSA as your cipher, because DSA isn’t FIPS-compliant.) **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --full-generate-key ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring example.kbx --full-generate-key gpg (GnuPG/MacGPG2) 2.2.41; Copyright (C) 2022 g10 Code GmbH This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) (14) Existing key from card Your selection? 1 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (3072) 4096 Requested keysize is 4096 bits Please specify how long the key should be valid. 0 = key does not expire = key expires in n days w = key expires in n weeks m = key expires in n months y = key expires in n years Key is valid for? (0) 0 Key does not expire at all Is this correct? (y/N) y GnuPG needs to construct a user ID to identify your key. Real name: Test Name must be at least 5 characters long Real name: TestName Email address: test@example.com Comment: You selected this USER-ID: "TestName " Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, move the mouse, utilize the disks) during the prime generation; this gives the random number generator a better chance to gain enough entropy. gpg: revocation certificate stored as '/Users/youruser/.gnupg/openpgp-revocs.d/991F7216B03C0B2B088AB20D5F46261934B56AF2.rev' public and secret key created and signed. pub rsa4096 2024-12-26 [SC] 991F7216B03C0B2B088AB20D5F46261934B56AF2 uid TestName sub rsa4096 2024-12-26 [E] ``` 4. List your keys to find out their fingerprints before migrating them to AES by running this command: **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --list-secret-keys --keyid-format=long --fingerprint C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --------------------------------------------------- sec rsa4096/5F46261934B56AF2 2024-12-26 [SC] Key fingerprint = 991F 7216 B03C 0B2B 088A B20D 5F46 2619 34B5 6AF2 uid [ultimate] TestName ssb rsa4096/E7C647D222B1F1C1 2024-12-26 [E] ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --list-secret-keys --keyid-format=long --fingerprint /Users/youruser/.gnupg/example.kbx ----------------------------------- sec rsa4096/5F46261934B56AF2 2024-12-26 [SC] Key fingerprint = 991F 7216 B03C 0B2B 088A B20D 5F46 2619 34B5 6AF2 uid [ultimate] TestName ssb rsa4096/E7C647D222B1F1C1 2024-12-26 [E] ``` ### Migrate Keys to AES > [!WARNING] This migration process may not work reliably with GPG 2.1 and later versions due to > `gpg-agent` limitations. If the migration fails, use the > [programmatic Bouncy Castle approach](#alternative-programmatic-key-generation) instead. Migrate each key to AES with SHA256 to make them FIPS compliant: 1. Copy the key to migrate fingerprint. 2. Paste the key in this ‌command without spaces. Note that running this command enables a command line: **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --s2k-cipher-algo AES256 --s2k-digest-algo SHA256 --s2k-mode 3 --s2k-count 65000000 --edit-key [KEYID] ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --s2k-cipher-algo AES256 --s2k-digest-algo SHA256 --s2k-mode 3 --s2k-count 65000000 --edit-key [KEYID] ``` 3. Enter the passwd command to change the key password. You can use the same password. A prompt requires the current password first and then the new one: ```bash passwd ``` 4. Exit the gpg prompt: - On Windows: Press `Ctrl+C` - On macOS: Press `Command+C` - On Linux: Press `Ctrl+C` 5. Repeat this procedure for each of the listed keys in your keybox. #### Verify Key Protection After creating or migrating a key, validate that the expected protection algorithms, AES-256 and SHA-256 are correctly applied. Run this command to inspect the actual protection applied to the secret key: ```xml gpg --export-secret-keys [KEYID] | gpg --list-packets ``` 1. In the output, look for a line similar to: iter+salt S2K, algo: 9, SHA256 protection, hash: 8 Use this reference to interpret the values:
AlgorithmHash Function

  • algo: 9 → AES256

  • algo: 7 → AES128

  • hash: 8 → SHA256

  • hash: 2 → SHA1

If the output shows AES128 or SHA1, it means the protection wasn’t correctly applied, and the key isn’t FIPS-compliant. In that case, repeat the migration process or consider using the next alternative approach. Note that SHA1 protection can still appear in GPG output due to the v4 packet format, even when SHA256 is used for the hash algorithm. For example: iter+salt S2K, algo: 9, SHA1 protection, hash: 8 In this case, `algo: 9` indicates AES256 encryption and `hash: 8` indicates SHA256 hashing. The "SHA1 protection" text refers to the packet format version, not the actual hash algorithm used. ==== FIPS Support Matrix
OperationFIPS SupportNotes

PGP Encrypt

Not supported — blocked by BCFIPS since RSA PKCS#1 v1.5 encryption is disallowed.

OpenPGP limitation in FIPS environments

PGP Decrypt

Supported

For legacy data compatibility

PGP Sign

Supported

With AES256 and SHA256 protection

PGP Validate

Supported

For legacy data compatibility

PGP Encrypt remains unsupported in FIPS environments by design due to OpenPGP limitations. However, PGP Decrypt and Validate operations are supported for processing legacy data. ==== GPG Behavior by Version
GPG VersionKey Generation CommandOutput Behavior

GPG 2.0 and lower

--gen-key

Output correctly shows AES-256 cipher and SHA-256 hash, but secret key packet still displays "SHA1 protection" field

GPG 2.1 and higher

--full-generate-key

Output correctly shows AES-256 cipher and SHA-256 hash, but secret key packet still displays "SHA1 protection" field

For both GPG versions, the "SHA1 protection" field in the secret key packet refers to the packet format version, not the actual protection algorithms used. ### Export Secret and Public Key After migrating the keys to AES (or generating them programmatically), export the secret and public keys: 1. Export the secret keys in a secret keyring to be used by the `mule-cryptography-module` module by running this command. This prompts you to enter the password for each of the secret keys in the keybox: **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --export-secret-keys > secring_example_aes.gpg ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --export-secret-keys > secring_example_aes.gpg ``` 1. Export the public keys if needed: **On Windows:** ```cmd gpg --no-default-keyring --keyring C:\Users\youruser\AppData\Roaming\gnupg\example.kbx --export > pubring_example_aes.gpg ``` **On Linux/macOS:** ```bash gpg --no-default-keyring --keyring /Users/youruser/.gnupg/example.kbx --export > pubring_example_aes.gpg ``` ### Troubleshoot Key Protection Issues In some cases, even after executing: ```xml gpg --s2k-cipher-algo AES256 --s2k-digest-algo SHA256 --s2k-mode 3 --s2k-count 65000000 --edit-key [KEYID] ``` The key may still appear protected with AES128 and SHA1. This is due to a change introduced in GPG 2.1 and later: secret key protection is no longer managed directly by `gpg`, but by `gpg-agent`. In GPG 2.1 and later, `gpg` isn’t directly responsible for encrypting secret keys at rest, and options such as `--s2k-cipher-algo` have no effect. Instead, `gpg-agent` is solely responsible and it provides no interface to change the cipher or digest algorithms in use. In practice: - S2K parameters passed on the command line or stored in `gpg.conf` aren’t applied when generating or editing keys in GPG 2.1+. - `gpg-agent` uses internal defaults — typically AES128 and SHA1 — with no configuration interface to change them. #### Alternative: Programmatic Key Generation with Bouncy Castle If you want to make secret keys protected with certain algorithms, like AES256 and SHA256, use Java and Bouncy Castle to make them directly. This approach gives you full control over: - Encryption algorithm: AES-256 - Hash digest: SHA-256 - S2K mode: Iterated and Salted (mode 3) - Iteration count: e.g., 65,000,000 This method ensures FIPS-compliant protection and is suitable for automated or controlled environments. ##### Complete Java Example for Programmatic Key Generation Create a Java class to generate FIPS-compliant PGP keys. This example creates a complete key pair with proper AES-256 and SHA-256 protection: ```java import org.bouncycastle.bcpg.ArmoredOutputStream; import org.bouncycastle.bcpg.HashAlgorithmTags; import org.bouncycastle.bcpg.sig.Features; import org.bouncycastle.bcpg.sig.KeyFlags; import org.bouncycastle.crypto.generators.RSAKeyPairGenerator; import org.bouncycastle.crypto.params.RSAKeyGenerationParameters; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.openpgp.*; import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptorBuilder; import org.bouncycastle.openpgp.operator.PGPDigestCalculator; import org.bouncycastle.openpgp.operator.bc.BcPBESecretKeyEncryptorBuilder; import org.bouncycastle.openpgp.operator.bc.BcPGPContentSignerBuilder; import org.bouncycastle.openpgp.operator.bc.BcPGPDigestCalculatorProvider; import org.bouncycastle.openpgp.operator.bc.BcPGPKeyPair; import java.io.*; import java.math.BigInteger; import java.security.SecureRandom; import java.security.Security; import java.util.Date; public class PGPKeyGenerator { static { if (Security.getProvider("BC") == null) { Security.addProvider(new BouncyCastleProvider()); } } public static void generateKeyPair( String identity, String passphrase, String secretKeyringPath, String publicKeyringPath, int keySize) throws Exception { // Generate RSA key pair RSAKeyPairGenerator keyPairGenerator = new RSAKeyPairGenerator(); RSAKeyGenerationParameters keyGenParams = new RSAKeyGenerationParameters( BigInteger.valueOf(0x10001), new SecureRandom(), keySize, 12); keyPairGenerator.init(keyGenParams); // Create PGP key pair BcPGPKeyPair signingKeyPair = new BcPGPKeyPair( PGPPublicKey.RSA_SIGN, keyPairGenerator.generateKeyPair(), new Date()); BcPGPKeyPair encryptionKeyPair = new BcPGPKeyPair( PGPPublicKey.RSA_ENCRYPT, keyPairGenerator.generateKeyPair(), new Date()); // Create key ring generator PGPKeyRingGenerator keyRingGen = new PGPKeyRingGenerator( PGPSignature.POSITIVE_CERTIFICATION, signingKeyPair, identity, new BcPGPDigestCalculatorProvider().get(HashAlgorithmTags.SHA256), null, null, new BcPGPContentSignerBuilder( signingKeyPair.getPublicKey().getAlgorithm(), HashAlgorithmTags.SHA256), createKeyEncryptor(passphrase)); // Add encryption subkey keyRingGen.addSubKey(encryptionKeyPair); // Generate secret key ring PGPSecretKeyRing secretKeyRing = keyRingGen.generateSecretKeyRing(); try (FileOutputStream fos = new FileOutputStream(secretKeyringPath); ArmoredOutputStream aos = new ArmoredOutputStream(fos)) { secretKeyRing.encode(aos); } // Generate public key ring PGPPublicKeyRing publicKeyRing = keyRingGen.generatePublicKeyRing(); try (FileOutputStream fos = new FileOutputStream(publicKeyringPath); ArmoredOutputStream aos = new ArmoredOutputStream(fos)) { publicKeyRing.encode(aos); } } private static PBESecretKeyEncryptorBuilder createKeyEncryptor(String passphrase) { PGPDigestCalculator sha256Calc = new BcPGPDigestCalculatorProvider() .get(HashAlgorithmTags.SHA256); return new BcPBESecretKeyEncryptorBuilder( PGPEncryptedData.AES_256, sha256Calc) .setProvider("BC") .setIterationCount(65000000); } public static void main(String[] args) throws Exception { generateKeyPair( "TestName ", "your-secure-passphrase", "secring_example_aes.gpg", "pubring_example_aes.gpg", 4096); } } ``` ##### Maven Dependencies Required Add these dependencies to your `pom.xml` to compile and run the key generation code: ```xml org.bouncycastle bcpg-jdk18on 1.80 org.bouncycastle bcprov-jdk18on 1.80 org.bouncycastle bcpkix-jdk18on 1.80 org.bouncycastle bcutil-jdk18on 1.80 ``` ##### Compile and Run **On Windows:** ```cmd javac -cp "bcpg-jdk18on-1.80.jar;bcprov-jdk18on-1.80.jar;bcpkix-jdk18on-1.80.jar;bcutil-jdk18on-1.80.jar" PGPKeyGenerator.java java -cp ".;bcpg-jdk18on-1.80.jar;bcprov-jdk18on-1.80.jar;bcpkix-jdk18on-1.80.jar;bcutil-jdk18on-1.80.jar" PGPKeyGenerator ``` **On Linux/macOS:** ```bash javac -cp "bcpg-jdk18on-1.80.jar:bcprov-jdk18on-1.80.jar:bcpkix-jdk18on-1.80.jar:bcutil-jdk18on-1.80.jar" PGPKeyGenerator.java java -cp ".:bcpg-jdk18on-1.80.jar:bcprov-jdk18on-1.80.jar:bcpkix-jdk18on-1.80.jar:bcutil-jdk18on-1.80.jar" PGPKeyGenerator ``` This generates `secring_example_aes.gpg` and `pubring_example_aes.gpg` files with FIPS-compliant AES-256 and SHA-256 protection. ### Configure the Cryptography Module to Use the Keyring Configure the Cryptography Module to use the generated keyring for signature and validation. 1. Copy the `secring_example.aes.gpg` and `pubring_example_aes.gpg` to your Mule project’s `src/main/resources` folder or to the ‌location inside your on-premises server. 2. Create a pop configuration like this to be used by the Cryptography Module PGP operations: ```xml ``` Notes for Cryptography Module PGP operations: - The fingerprint used for validation can be the complete value or the last 16 characters, as shown in the previous example. - The org.mule.runtime.api.exception.MuleRuntimeException may be thrown at runtime in FIPS environments if the sign operation fails to generate the signed content. This can occur if the InputStream is empty or corrupted, or if a non-compliant cipher is configured in the keyrings or generated PGP keys. Make sure your keyring and keys follow the guidelines in this migration guide. - DSA encryption isn’t allowed because DSA isn’t a FIPS-compliant cipher. - ECDSA or RSA PKCS v1.5 algorithms are no longer allowed for encryption in FIPS environments. If you use the PGP Encrypt operation with these algorithms, you can get these errors: - "RSA PKCS#1 v1.5 encryption disallowed" - "Can’t use ECDSA for encryption" - "ElGamal KeyFactory not available" - RSA encryption using PKCS#1 v1.5 is also disabled in FIPS mode. While you can reenable it using the system property `-Dorg.bouncycastle.rsa.allow_pkcs15_enc=true`, don’t enable it so you can maintain strict FIPS compliance. Enable it only if necessary and you understand the security implications. ## Use Different Key Pair for Sign, Encrypt, and Decrypt Operations If you use the same key pair, especially when using Bouncy Castle FIPS as a security provider or running your Mule app on MuleSoft Government Cloud, you can get this error: ```xml org.mule.runtime.api.component.execution.ComponentExecutionException: org.bouncycastle.crypto.IllegalKeyException: Attempt to sign/verify with RSA modulus already used for encrypt/decrypt ``` Therefore, use different key pairs for Sign, Encrypt, and Decrypt operations. ## Use Password-Based Encryption When using a FIPS-enabled environment, password-based encryption (PBE) algorithms starting with PBEWith are no longer supported because of security limits. For example: - `PBEWithSHA1AndRC2_40` - `PBEWithSHA1AndRC2_128` - `PBEWithSHA1AndRC4_128` - `PBEWithSHA1AndRC4_40` - `PBEWithMD5AndDES` - `PBEWithMD5AndTripleDES` - `PBEWithSHA1AndDESede` To ensure compliance, all password-based encryption implementations in FIPS mode follow these rules: - Your password must be at least 16 characters long. - A password SALT is mandatory for all PBE operations. This password must be at least 16 characters long. Furthermore, for enhanced security, you must change the password SALT for each configured operation. - For sign or validate, the default algorithm is PBKDF2withHmacSHA512. - For encrypt or decrypt, the default algorithm is PBKDF2withHmacSHA512_AES256_CBC\_\_PKCS5Padding - JCE PBE operations in FIPS environments require both a password SALT and an iteration count. You must update the module configurations to provide these values for all PBE operations. If you have data that was encrypted without a SALT and iteration count, you have these options: - Decrypt it outside of FIPS mode. - Temporarily enable the `com.mulesoft.crypto.allow-default-kdf-params` system property to decrypt it within FIPS, and then re-encrypt it using the new configuration. Also, in a FIPS environment, you must enable the `` com.mulesoft.crypto.allow-sun-pbe-in-fips` `` system property to allow the use of SUN algorithms. ## Specify Algorithms Dynamically Cryptography Module version 2.1.0 supports dynamic algorithm definitions, offering great flexibility by removing the dependency of a predefined list of available values shown in the value provider. You can specify dynamic algorithm definitions in two ways: - As a complete transformation string available in your environment’s registered security providers (for example `PBEWithHmacSHA256AndAES_128`, `PBEwithSHA1and3-KeyDESede`, and so on). - As a custom algorithm format introduced in version 2.1.0, which is detailed in the next section. > [!NOTE] Algorithms not present in your Mule runtime’s `Security.getProviders()` list result in > runtime errors. If needed, make sure you include the required cryptographic providers, for example > BouncyCastle FIPS, BC non-FIPS, in your Mule app’s classpath or security configuration. ### Use Custom Algorithm Format To enable better support for modern cryptographic configurations, especially in FIPS environments, Cryptography Module version 2.1.0 introduces a custom algorithm format that separates key derivation and encryption components. Format: `PBKDF2withHmac_AES___` Example: `PBKDF2withHmacSHA512_AES256_CBC__PKCS5Padding` This format: - Ensures full compatibility with FIPS-approved cryptographic profiles. - Provides explicit definition of key length, block mode, and padding. - Enables support for future extensions without requiring changes to the connector code or Studio configuration. You must define all four components. Defaults aren’t assumed. If a component is missing or malformed, ‌validation fails.
ComponentDescription

PBKDF2withHmac<digest>

Key derivation function (KDF) using HMAC + SHA512

AES<keyLength>

Cipher algorithm with key size (128, 192, 256)

mode

Cipher block mode (for example CBC, GCM)

padding

Padding scheme (for example PKCS5Padding, NoPadding)

Additionally, the default algorithm values are updated for stronger cryptographic guarantees:
OperationDefault value Cryptography Module version 1.xDefault value Cryptography Module version 2.x

Encrypt or Decrypt

PBEWithHmacSHA256AndAES_128

PBKDF2withHmacSHA512AES256CBC__PKCS5Padding

Sign or Validate

PBEWithHmacSHA256

`PBKDF2withHmacSHA512

## Register the XMLDSig Security Provider Cryptographic operations involving XML signatures (for example XML Sign, XML Encrypt, XML Decrypt, and XML Validate) require the XMLDSig security provider (org.jcp.xml.dsig.internal.dom.XMLDSigRI), commonly provided by Apache Santuario. In FIPS-compliant environments, this provider might not be available or registered by default due to stricter security policies. To enable these XML-related cryptographic operations, the module can register the provider if you explicitly set this system property: `` -Dcom.mulesoft.connectors.allow-registration-of-xmldsig-provider-in-fips` `` This action registers the provider at the JVM level, making it globally available to all Mule apps running on the same JVM. Only use this setting if your Mule app explicitly requires XML signature or encryption support and the provider isn’t already present. ## Enable Compatibility for Decrypt or Validate Operations without KDF Parameters In Cryptography Module version 2.1, password-based encryption operations now enforce the configuration of both SALT and `iterationCount` parameters for enhanced security. To make sure your Mule app still decrypts or validates data that was encrypted or signed using Cryptography Module version 1.x, where SALT and `iterationCount` weren’t mandatory, activate these system properties: ```xml com.mulesoft.crypto.allow-default-kdf-params=true com.mulesoft.crypto.allow-sun-pbe-in-fips=true (only necessary when running in a FIPS-enabled environment) ``` Activating these system properties enables ‌compatibility mode under these conditions: - The operation is either Decrypt or Validate. - The encryption algorithm is based on Sun’s PBE schemes, for example, `PBEWithHmacSHA1AndAES_128`. - Neither SALT nor `iterationCount` parameters are explicitly provided (null or empty). If you provide a value for either SALT or `iterationCount` parameters, the module targets version 2.x compatibility and intentionally fails the operation to avoid inconsistent behavior. This compatibility mode is intended as a temporary solution to handle existing data. For all new data, make sure you configure both SALT and `iterationCount` as required by Cryptography Module version 2.x for optimal security and behavior. ## Use BCFKS as the Required Keystore and Truststore Type To enhance security compliance, the Bouncy Castle FIPS Keystore (BCFKS) type is mandatory for all Mule apps running in FIPS mode. You must migrate your existing Java KeyStore (JKS) or Public-Key Cryptography Standards #12 (PKCS12) keystores and truststores to BCFKS and update your mule-cryptography-module configurations to reference these new files: 1. Download Bouncy Castle FIPS Provider: ```xml curl -o $JAVA_HOME/jre/lib/ext/bc-fips-1.0.2.5.jar https://repo1.maven.org/maven2/org/bouncycastle/bc-fips/1.0.2.5/bc-fips-1.0.2.5.jar ``` 2. For JKS Keystores execute this keytool command, replacing `` with your current keystore password and adjusting the file paths accordingly: ```xml sudo /absolute/path/to/keytool_command/keytool -importkeystore -srckeystore /absolut/path/to/your/keystore/keystore.jks -srcstoretype JKS -srcstorepass changeit -destkeystore /absolute/path/to/new/keystore/keystore.bcfks -storepass -deststoretype BCFKS -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider -providerpath /absolut/path/to/bcfips-1.0.2.5.jar ``` For PKCS12 Keystores if your current keystore is in PKCS12 format, simply replace -srcstoretype JKS with -srcstoretype PKCS12 in the previous command. > [!NOTE] In FIPS environments, JKS can only store certificates and can’t hold private or secret > keys. JKS isn’t enabled by default in Bouncy Castle FIPS. To use JKS, enable it by setting the > system property: `` org.bouncycastle.jca.enable_jks=true` `` JKS is no longer the default keystore type. You must explicitly select the keystore type. In FIPS environments, BCFKS is required. ## JCE Keystore Generation Example Use **JCE Encrypt** as an alternative to **PGP Encrypt** when operating in a FIPS environment. PGP Encrypt is not supported in FIPS environments because the OpenPGP standard (RFC 4880) mandates the use of RSAES-PKCS1-v1\_5, which is strictly prohibited in FIPS mode. For more information, refer to [Scope and Limitations (FIPS)](#scope-and-limitations-fips). To use JCE Encrypt in a FIPS environment, you must first generate a JCE keystore: 1. Download Bouncy Castle FIPS Provider: ```xml curl -o $JAVA_HOME/jre/lib/ext/bc-fips-1.0.2.5.jar https://repo1.maven.org/maven2/org/bouncycastle/bc-fips/1.0.2.5/bc-fips-1.0.2.5.jar ``` 2. Generate the keystore. In this example, you generate a BCFKS using the AES symmetric algorithm: ```xml keytool -genseckey -alias -keyalg AES -keysize 256 \ -keystore keystore.bcfks -storetype BCFKS \ -providerclass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \ -providerpath /absolute/path/to/bc-fips-1.0.2.5.jar ``` ## See Also - [Cryptography Module Reference 2.2](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference) --- product: Cryptography Module version: 2.0 --- # Using Anypoint Studio to Configure Cryptography Module 2.0 > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Anypoint Studio (Studio) editors help you design and update your Mule applications, properties, and configuration files. To add and configure a connector in Studio: 1. [Create a Mule project](#create-mule-project). 2. [Add the connector to your Mule project](#add-connector-to-project). 3. [Configure a source for the connector’s flow](#configure-source). 4. [Add a connector operation to the flow](#add-connector-operation). When you run the connector, you can view the app log to check for problems in real time, as described in [View the App Log](#view-app-log). If you are new to configuring connectors in Studio, see [Using Anypoint Studio to Configure a Connector](https://docs.mulesoft.com/connectors/introduction/intro-config-use-studio). If, after reading this topic, you need additional information about the connector fields, see the [Cryptography Module Reference](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference). ## Create a Mule Project In Studio, create a new Mule project in which to add and configure the connector: 1. In Studio, select **File > New > Mule Project**. 2. Enter a name for your Mule project and click **Finish**. ## Add the Connector to Your Mule Project Add Cryptography Module to your Mule project to automatically populate the XML code with the connector’s namespace and schema location and add the required dependencies to the project’s `pom.xml` file: 1. In **Mule Palette**, click **(X) Search in Exchange**. 2. In **Add Dependencies to Project**, type `cryptopgraphy` in the search field. 3. Click Cryptography Module in **Available modules**. 4. Click **Add**. 5. Click **Finish**. Adding a connector to a Mule project in Studio does not make that connector available to other projects in your Studio workspace. ## Configure a Source A source initiates a flow when a specified condition is met. You can configure one of these sources to use with Compression module: - HTTP Listener Initiates a flow each time it receives a request on the configured host and port - Scheduler Initiates a flow when a time-based condition is met For example, to configure an HTTP Listener source, follow these steps: 1. In **Mule Palette**, select **HTTP > Listener**. 2. Drag **Listener** to the Studio canvas. 3. On the **Listener** configuration screen, optionally change the value of the **Display Name** field. 4. Specify a value for the **Path** field. 5. Click the plus sign (**+**) next to the **Connector configuration** field to configure a global element that can be used by all instances of the HTTP Listener source in the app. 6. On the **General** tab, specify connection information for the connector. 7. On the **TLS** tab, optionally specify the TLS information for the connector. 8. On the **Advanced** tab, optionally specify reconnection information, including a reconnection strategy. 9. Click **Test Connection** to confirm that Mule can connect with the specified server. 10. Click **OK**. ## Add a Connector Operation to the Flow When you add a connector operation to your flow, you are specifying an action for that connector to perform. To add an operation for Compression module, follow these steps: 1. In **Mule Palette**, select **Cryptography** and then select the desired operation. 2. Drag the operation onto the Studio canvas, next to the input source. ![Cryptography module operations in Mule palette](/mulesoft/current/en-us/cryptography-module/2.0/_images/cryptography-module-operations.png) ## View the App Log To check for problems, you can view the app log as follows: - If you’re running the app from Anypoint Platform, the app log output goes to the Anypoint Studio console window. - If you’re running the app using Mule from the command line, the app log output goes to your operating system console. Unless the log file path is customized in the app’s log file (`log4j2.xml`), you can also access the app log in the default location `MULE_HOME/logs/.log`. You can configure the location of the log path in the app log file `log4j2.xml`. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Using Anypoint Studio to Configure a Connector](https://docs.mulesoft.com/connectors/introduction/intro-config-use-studio) - [Cryptography Module Reference](https://docs.mulesoft.com/cryptography-module/2.0/cryptography-module-reference) --- product: Cryptography Module version: 2.1 --- # Using Anypoint Studio to Configure Cryptography Module 2.1 > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Anypoint Studio (Studio) editors help you design and update your Mule applications, properties, and configuration files. To add and configure a connector in Studio: 1. [Create a Mule project](#create-mule-project). 2. [Add the connector to your Mule project](#add-connector-to-project). 3. [Configure a source for the connector’s flow](#configure-source). 4. [Add a connector operation to the flow](#add-connector-operation). When you run the connector, you can view the app log to check for problems in real time, as described in [View the App Log](#view-app-log). If you are new to configuring connectors in Studio, see [Using Anypoint Studio to Configure a Connector](https://docs.mulesoft.com/connectors/introduction/intro-config-use-studio). If, after reading this topic, you need additional information about the connector fields, see the [Cryptography Module Reference](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference). ## Create a Mule Project In Studio, create a new Mule project in which to add and configure the connector: 1. In Studio, select **File > New > Mule Project**. 2. Enter a name for your Mule project and click **Finish**. ## Add the Connector to Your Mule Project Add Cryptography Module to your Mule project to automatically populate the XML code with the connector’s namespace and schema location and add the required dependencies to the project’s `pom.xml` file: 1. In **Mule Palette**, click **(X) Search in Exchange**. 2. In **Add Dependencies to Project**, type `cryptopgraphy` in the search field. 3. Click Cryptography Module in **Available modules**. 4. Click **Add**. 5. Click **Finish**. Adding a connector to a Mule project in Studio does not make that connector available to other projects in your Studio workspace. ## Configure a Source A source initiates a flow when a specified condition is met. You can configure one of these sources to use with Compression module: - HTTP Listener Initiates a flow each time it receives a request on the configured host and port - Scheduler Initiates a flow when a time-based condition is met For example, to configure an HTTP Listener source, follow these steps: 1. In **Mule Palette**, select **HTTP > Listener**. 2. Drag **Listener** to the Studio canvas. 3. On the **Listener** configuration screen, optionally change the value of the **Display Name** field. 4. Specify a value for the **Path** field. 5. Click the plus sign (**+**) next to the **Connector configuration** field to configure a global element that can be used by all instances of the HTTP Listener source in the app. 6. On the **General** tab, specify connection information for the connector. 7. On the **TLS** tab, optionally specify the TLS information for the connector. 8. On the **Advanced** tab, optionally specify reconnection information, including a reconnection strategy. 9. Click **Test Connection** to confirm that Mule can connect with the specified server. 10. Click **OK**. ## Add a Connector Operation to the Flow When you add a connector operation to your flow, you are specifying an action for that connector to perform. To add an operation for Compression module, follow these steps: 1. In **Mule Palette**, select **Cryptography** and then select the desired operation. 2. Drag the operation onto the Studio canvas, next to the input source. ![Cryptography module operations in Mule palette](/mulesoft/current/en-us/cryptography-module/2.1/_images/cryptography-module-operations.png) ## View the App Log To check for problems, you can view the app log as follows: - If you’re running the app from Anypoint Platform, the app log output goes to the Anypoint Studio console window. - If you’re running the app using Mule from the command line, the app log output goes to your operating system console. Unless the log file path is customized in the app’s log file (`log4j2.xml`), you can also access the app log in the default location `MULE_HOME/logs/.log`. You can configure the location of the log path in the app log file `log4j2.xml`. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Using Anypoint Studio to Configure a Connector](https://docs.mulesoft.com/connectors/introduction/intro-config-use-studio) - [Cryptography Module Reference](https://docs.mulesoft.com/cryptography-module/2.1/cryptography-module-reference) --- product: Cryptography Module version: 2.2 is-latest-version: true --- # Using Anypoint Studio to Configure Cryptography Module 2.2 > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Anypoint Studio (Studio) editors help you design and update your Mule applications, properties, and configuration files. To add and configure a connector in Studio: 1. [Create a Mule project](#create-mule-project). 2. [Add the connector to your Mule project](#add-connector-to-project). 3. [Configure a source for the connector’s flow](#configure-source). 4. [Add a connector operation to the flow](#add-connector-operation). When you run the connector, you can view the app log to check for problems in real time, as described in [View the App Log](#view-app-log). If you are new to configuring connectors in Studio, see [Using Anypoint Studio to Configure a Connector](https://docs.mulesoft.com/connectors/introduction/intro-config-use-studio). If, after reading this topic, you need additional information about the connector fields, see the [Cryptography Module Reference](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference). ## Create a Mule Project In Studio, create a new Mule project in which to add and configure the connector: 1. In Studio, select **File > New > Mule Project**. 2. Enter a name for your Mule project and click **Finish**. ## Add the Connector to Your Mule Project Add Cryptography Module to your Mule project to automatically populate the XML code with the connector’s namespace and schema location and add the required dependencies to the project’s `pom.xml` file: 1. In **Mule Palette**, click **(X) Search in Exchange**. 2. In **Add Dependencies to Project**, type `cryptopgraphy` in the search field. 3. Click Cryptography Module in **Available modules**. 4. Click **Add**. 5. Click **Finish**. Adding a connector to a Mule project in Studio does not make that connector available to other projects in your Studio workspace. ## Configure a Source A source initiates a flow when a specified condition is met. You can configure one of these sources to use with Compression module: - HTTP Listener Initiates a flow each time it receives a request on the configured host and port - Scheduler Initiates a flow when a time-based condition is met For example, to configure an HTTP Listener source, follow these steps: 1. In **Mule Palette**, select **HTTP > Listener**. 2. Drag **Listener** to the Studio canvas. 3. On the **Listener** configuration screen, optionally change the value of the **Display Name** field. 4. Specify a value for the **Path** field. 5. Click the plus sign (**+**) next to the **Connector configuration** field to configure a global element that can be used by all instances of the HTTP Listener source in the app. 6. On the **General** tab, specify connection information for the connector. 7. On the **TLS** tab, optionally specify the TLS information for the connector. 8. On the **Advanced** tab, optionally specify reconnection information, including a reconnection strategy. 9. Click **Test Connection** to confirm that Mule can connect with the specified server. 10. Click **OK**. ## Add a Connector Operation to the Flow When you add a connector operation to your flow, you are specifying an action for that connector to perform. To add an operation for Compression module, follow these steps: 1. In **Mule Palette**, select **Cryptography** and then select the desired operation. 2. Drag the operation onto the Studio canvas, next to the input source. ![Cryptography module operations in Mule palette](/mulesoft/current/en-us/cryptography-module/latest/_images/cryptography-module-operations.png) ## View the App Log To check for problems, you can view the app log as follows: - If you’re running the app from Anypoint Platform, the app log output goes to the Anypoint Studio console window. - If you’re running the app using Mule from the command line, the app log output goes to your operating system console. Unless the log file path is customized in the app’s log file (`log4j2.xml`), you can also access the app log in the default location `MULE_HOME/logs/.log`. You can configure the location of the log path in the app log file `log4j2.xml`. ## See Also - [Introduction to Anypoint Connectors](https://docs.mulesoft.com/connectors/introduction/introduction-to-anypoint-connectors) - [Using Anypoint Studio to Configure a Connector](https://docs.mulesoft.com/connectors/introduction/intro-config-use-studio) - [Cryptography Module Reference](https://docs.mulesoft.com/cryptography-module/latest/cryptography-module-reference)