> For the complete documentation index, see [llms.txt](https://docs.zigiwave.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zigiwave.com/security/encryption.md). # Encryption ## Overview ZigiOps protects sensitive data at every layer of the platform. By default, all credentials, authentication details, and security related HTTP headers are encrypted using a FIPS 140-2 compliant algorithm. For organizations with stricter security requirements, ZigiOps also supports external encryption providers, including Hardware Security Modules (HSM), through the Java Cryptography Architecture (JCA). ## Default Encryption ZigiOps encrypts sensitive data that is visible in the UI or stored on the filesystem, such as configuration files and logs. The default encryption is FIPS 140-2 compliant and uses the following specification: * **Algorithm:** AES/CBC * **Key size:** 256-bit The following categories of data are encrypted by default: * All authentication details, including passwords, tokens, and security keys. * All HTTP request details, including Authorization headers, Set-Cookie headers, and other security related headers. ## External Security Provider ZigiOps supports external security providers for encryption through the Java Cryptography Architecture (JCA). This allows organizations to integrate Hardware Security Modules (HSM) or other JCA-compatible providers to handle encryption operations outside the platform. ## Hardware Security Module (HSM) ### How to Enable HSM By default, ZigiOps uses its internal encryption mechanism. To switch to an HSM, follow the steps below. These steps reset the default Admin credentials before the JCA takes over credential management. {% stepper %} {% step %} ## Stop the ZigiOps services {% endstep %} {% step %} ## Remove existing credential folders Navigate to `\conf\platform\settings` and remove the `accounts`, `credentials`, and `users` folders. {% endstep %} {% step %} ## Start the ZigiOps services {% endstep %} {% endstepper %} This procedure resets the login credentials for the default Admin user to their default values and allows the JCA to begin handling credentials after the next launch. Before starting the ZigiOps service again, configure the required runtime parameters in the `config.properties` file, located at `\platform\conf`. Open the file in any text editor and add the following parameters at the end of the file: ```properties zigiwave.jca.provider=CryptoServer zigiwave.jca.keystore.type=CryptoServer zigiwave.jca.algorithm=DES/CBC/PKCS5Padding zigiwave.jca.keysize=1024 zigiwave.jca.keystore.password=MTIzNDU2 zigiwave.jca.keystore.alias=test1234 ``` {% hint style="info" %} The example above uses a simulator. Replace these values with those provided by your actual hardware security module. {% endhint %} ### HSM Parameters The following parameters are available for HSM configuration. These parameters are not present in the `config.properties` file by default and must be added manually. | Parameter | Details | Default Value | | -------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------ | | `zigiwave.jca.provider` | The provider string. | SunJCE | | `zigiwave.jca.algorithm` | The type of algorithm used for encoding. | AES | | `zigiwave.jca.keysize` | The key size. | 1024 | | `zigiwave.jca.keystore.type` | The Keystore type. | JCEKS | | `zigiwave.jca.keystore.alias` | Alias in the Keystore that will store the secret key. | zigiwave-credential-secret-key | | `zigiwave.jca.keystore.file` | Location in the Keystore file system. Not needed for external vendors. | conf/credstore | | `zigiwave.jca.keystore.password` | The password to access the Keystore. May or may not be required by an external vendor. Encoded in Base64. | | ### How to Disable HSM Once the HSM is enabled and configured, it manages all encryption and decryption tasks, including login credentials and data from integrated systems. If the HSM is stopped or disabled at any point: * Users will no longer be able to log in to ZigiOps. * System data will remain encrypted. * All integration activities will halt. Restoring access to the HSM will allow ZigiOps to return to its normal operational state. Integration activities will resume after a service restart. If the host system is compromised or a new key has been generated, restore access to the ZigiOps UI by following these steps: {% stepper %} {% step %} ## Stop the ZigiOps services {% endstep %} {% step %} ## Remove existing credential folders Navigate to `\platform\conf\settings` and remove the `accounts`, `credentials`, and `users` folders. {% endstep %} {% step %} ## Start the ZigiOps services {% endstep %} {% endstepper %} {% hint style="info" %} After restoring, ZigiOps will still initialize the integrated systems. However, you will need to re-enter system passwords and save them again from the Connected Systems menu to ensure the newly generated key can handle them. {% endhint %} ## Network Encryption The ZigiOps cloud version is accessible exclusively over HTTPS. All traffic is encrypted and protected from interception by unauthorized parties. ZigiWave follows current best practices for network security, including: * TLS 1.3 and TLS 1.2 encryption protocols. * Minimum key length of 128 bits. ZigiOps uses secure protocols for communication with third-party systems. HTTPS is the standard protocol, but SFTP and FTPS are also supported where required. For connecting to on-premises systems, ZigiOps requires the installation of an agent. The agent can be deployed behind firewalls and communicates outbound to ZigiOps over an encrypted TLS 1.2 link. The on-premises version of ZigiOps is installed behind the customer's firewalls and is accessible only to authenticated users. ## Compliance ZigiOps encryption is designed to meet the following compliance standards: * **FIPS 140-2:** ZigiOps encrypts integration configuration data in full compliance with the FIPS 140-2 standard. * **ISO 27001:** ZigiWave is ISO 27001 certified, demonstrating adherence to international information security management standards. ## Frequently Asked Questions
What encryption algorithm does ZigiOps use by default? ZigiOps uses AES/CBC with a 256-bit key size by default, which is FIPS 140-2 compliant.
Can ZigiOps integrate with a Hardware Security Module (HSM)? Yes. ZigiOps supports external encryption providers, including HSMs, through the Java Cryptography Architecture (JCA).
What happens if the HSM becomes unavailable? Users will be unable to log in and all integration activities will halt until access to the HSM is restored.
What TLS versions does ZigiOps support for network encryption? ZigiOps supports TLS 1.2 and TLS 1.3 with a minimum key length of 128 bits.
## Related Pages * Authentication (Single Sign-On) * Hardening Web App * Hardware Security Module (HSM) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.zigiwave.com/security/encryption.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.