Encryption Connection Parameter [ENC]

Encrypts packets sent between the client application and the database server using transport-layer security or simple encryption.

Usage

For TLS, TCP/IP only

For NONE or SIMPLE, anywhere

Values

String

Default

NONE

If an Encryption value is not set, encryption is controlled by the setting on the server, which defaults to no encryption.

Description

You can use this parameter if you are concerned about the security of network packets. Encryption marginally affects performance. The Encryption (ENC) connection parameter accepts these arguments:

  • None accepts communication packets that are unencrypted.

  • Simple accepts communication packets that are encrypted with simple encryption supported on all platforms and on pre-12.6 versions of SAP Sybase IQ. Simple encryption does not provide server authentication, RSA encryption, or other features of transport-layer security.

  • TLS accepts communication packets that are encrypted using RSA encryption technology. For FIPS-certified RSA encryption, specify FIPS=Y. RSA FIPS uses a separate certified library, but is compatible with SAP Sybase IQ servers specifying RSA. TLS connections are supported between client and server on all supported platforms but FIPS=Y is only supported on LinuxAMD and Windows (32 and 64-bit).To authenticate the server, the software verifies that the server's certificate values match any values you supply about the client using the following arguments:

    • trusted_certificate specifies the certificate file the client uses to authenticate the server.

    • certificate_company specifies the value for the organization field. The server's value and the client's value must match.

    • certificate_unit specifies the value for the organization unit field. The server's value and the client's value must match.

    • certificate_name specifies the certificate's common name. The server's value and the client's value must match.

Warning!  Use the sample certificate only for testing purposes. It provides no security in deployed situations because it and the corresponding password are widely distributed with SAP Sybase IQ software. To protect your system, create your own certificate.

You can use the CONNECTION_PROPERTY system function to retrieve the encryption settings for the current connection.

Examples

  • This connection string fragment connects to a database server myeng with a TCP/IP link, using RSA encryption and the sample trusted certificate:

    "ENG=myeng; LINKS=tcpip; Encryption=(FIPS=N;TRUSTED_CERTIFICATE=iq-16_0/samples/certificates/rsaroot.crt)"