Encryption
Encryption is automatically handled by Management Center.
Encryption is automatically handled by Management Center.
First time installation environment data is set for encryption. This resulting in all underlying service will have encryption/decryption.
Encryption settings are read from /etc/systemd/system/frtfd.env
Encryption is not enabled by default. This is enabled by setting environment variables:
- FORTIFIED_SECRETS_SECRET - The secret used for encryption DO NOT SHARE THIS.
- FORTIFIED_SECRETS_KEY_SIZE - Key size, allowed values are 128 or 256.
- FORTIFIED_SECRETS_IMPL=localgcm
Generating a Secret Key
Section titled “Generating a Secret Key”Key Format Requirements
Section titled “Key Format Requirements”- Encoding: The key must be represented in hexadecimal format (characters 0-9 and a-f).
- Length:
- A 128-bit key → exactly 32 hexadecimal characters (16 bytes).
- A 256-bit key → exactly 64 hexadecimal characters (32 bytes).
- Case Sensitivity: Hexadecimal characters may be in lowercase or uppercase, but lowercase is recommended for consistency.
- Character Set: No spaces, line breaks, or additional characters are allowed — the key must be a continuous hex string.
- Entropy: Keys must be generated using a cryptographically secure random number generator (CSPRNG), not predictable sources.
The openssl rand command generates cryptographically secure random bytes.
When the -hex flag is used, the output is represented in hexadecimal format.
The number following -hex specifies the number of bytes to generate.
Since each byte is represented by two hexadecimal characters:
- openssl rand -hex 16 → 16 bytes (32 hex characters, 128-bit key)
- openssl rand -hex 32 → 32 bytes (64 hex characters, 256-bit key)
Examples:
# Generate a 128-bit (16 bytes) keyopenssl rand -hex 16
# Generate a 256-bit (32 bytes) keyopenssl rand -hex 32In PowerShell, you can use the .NET System.Security.Cryptography.RandomNumberGenerator class to produce the same cryptographically secure random data.
Examples:
# Generate a 128-bit (16 bytes) key[byte[]]$bytes = New-Object byte[] 16[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)($bytes | ForEach-Object { $_.ToString("x2") }) -join ""
# Generate a 256-bit (32 bytes) key[byte[]]$bytes = New-Object byte[] 32[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)($bytes | ForEach-Object { $_.ToString("x2") }) -join ""