> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/management-center/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/management-center/operations/encryption.md).

# Encryption

### Windows

First time installation environment data is set for encryption. This resulting in all underlying service will have encryption/decryption.

### Linux

Encryption settings are read from `/etc/systemd/system/frtfd.env`

## Container

Encryption is not enabled by default. This is enabled by setting environment variables:

* FORTIFIED\_SECRETS\_SECRET - The secret used for encryption DO NOT SHARE THIS.
* FORTIFIED\_SECRETS\_KEY\_SIZE - Key size, allowed values are 128 or 256.
* FORTIFIED\_SECRETS\_IMPL=localgcm

### Generating a Secret Key

#### Key Format Requirements

* Encoding: The key must be represented in hexadecimal format (characters 0-9 and a-f).
* Length:
  * A 128-bit key → exactly 32 hexadecimal characters (16 bytes).
  * A 256-bit key → exactly 64 hexadecimal characters (32 bytes).
* Case Sensitivity: Hexadecimal characters may be in lowercase or uppercase, but lowercase is recommended for consistency.
* Character Set: No spaces, line breaks, or additional characters are allowed — the key must be a continuous hex string.
* Entropy: Keys must be generated using a cryptographically secure random number generator (CSPRNG), not predictable sources.

\
Using OpenSSL

The openssl rand command generates cryptographically secure random bytes.

When the -hex flag is used, the output is represented in hexadecimal format.

The number following -hex specifies the number of bytes to generate.

Since each byte is represented by two hexadecimal characters:

* openssl rand -hex 16 → 16 bytes (32 hex characters, 128-bit key)
* openssl rand -hex 32 → 32 bytes (64 hex characters, 256-bit key)

Examples:

```bash
# Generate a 128-bit (16 bytes) key
openssl rand -hex 16

# Generate a 256-bit (32 bytes) key
openssl rand -hex 32
```

***

#### Using PowerShell

In PowerShell, you can use the .NET System.Security.Cryptography.RandomNumberGenerator class to produce the same cryptographically secure random data.<br>

Examples:

```powershell
# Generate a 128-bit (16 bytes) key
[byte[]]$bytes = New-Object byte[] 16
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
($bytes | ForEach-Object { $_.ToString("x2") }) -join ""

# Generate a 256-bit (32 bytes) key
[byte[]]$bytes = New-Object byte[] 32
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
($bytes | ForEach-Object { $_.ToString("x2") }) -join ""  
```

{% hint style="warning" %}
Do not change encryption settings once set. This may cause faulty behaviour.
{% endhint %}