Configure Adaptive Server for Clients Using EPEP Algorithm

An Adaptive Server can be configured to require the Extended Plus Encrypted Password (EPEP) login protocol using sp_configure.

An additional value has been added to sp_configure 'net password encryption reqd' to indicate that the server should only allow incoming clients using EPEP algorithm.

The configuration parameter net password encryption reqd supports a value of 3, which indicates the server should only allow incoming clients that are using EPEP login protocol. The values 0, 1, and 2 will also allow EPEP login protocol to be used when a client that supports the login protocol attempts to use it with an Adaptive Server that implements the EPEP login protocol.

Setting the value to 2 or 3 increases network memory in order to support the maximum configured connections using this protocol. The additional network memory configuration parameter is used to dynamically add more memory to the network memory pool used by EPEP. When the value is set to 3, the KPP Handler goes into sleep status. This is because there is no need to provide new RSA key pair for every connection. You can use the sp_who command to check the KPP Handler status.

Note: Adaptive Server supports two versions of the login protocol using RSA asymmetric encryption. See "Securing login passwords on the network" in the Security Administration Guide for more information.