Encryption (ENC) connection parameter

Encrypts packets sent between the client application and the database server using transport-layer security or simple encryption.

Syntax

{ Encryption | ENC }={ NONE
 | SIMPLE 
 | TLS (  [ FIPS={ Y | N }; ]
   TRUSTED_CERTIFICATE=public-certificate;
    [ CERTIFICATE_COMPANY=organization; ]
    [ CERTIFICATE_NAME=common-name; ]
    [ CERTIFICATE_UNIT=organization-unit ] )

Usage

Allowed values

NONE Accepts communication packets that are not encrypted.
SIMPLE Accepts communication packets that are encrypted with simple encryption supported on all platforms and on previous versions of SQL Anywhere. Simple encryption does not provide server authentication, RSA encryption, or other features of transport-layer security.
If the database server accepts simple encryption, but does not accept no encryption, then any non-TDS connection attempts using no encryption automatically uses simple encryption.

Starting the database server with -ec SIMPLE tells the database server to accept only connections using simple encryption. TLS connections (RSA, and RSA FIPS-certified) fail, and connections requesting no encryption use simple encryption.
TLS Accepts communication packets that are encrypted with RSA encryption. For FIPS-certified RSA encryption, specify FIPS=Y. RSA FIPS uses a separate certified library, but is compatible with SQL Anywhere 9.0.2 or later with servers specifying RSA.
The connection fails if the algorithm does not match the encryption used to create your certificates.

The client can use the following arguments to verify the field values in the server's public certificate:
- trusted_certificate
- certificate_company
- certificate_unit
- certificate_name
For more information about verifying certificate fields for server authentication, see Verifying certificate fields.

Default

Remarks

You can use this parameter to secure communications between client applications and the database server using transport-layer security or simple encryption.

Note

Separately licensed component required.

FIPS-certified encryption requires a separate license. All strong encryption technologies are subject to export regulations.

See Separately licensed components.

You can use the CONNECTION_PROPERTY system function to retrieve the encryption settings for the current connection:

SELECT CONNECTION_PROPERTY ( 'Encryption' );

The function returns one of the following values: None, Simple, rsa_tls, or rsa_tls_fips depending which type of encryption is being used by the connection.

See CONNECTION_PROPERTY function [System].

Example

The following connection string fragment connects to a database server using transport-layer security and RSA encryption:

"HOST=myhost;SERVER=myserver;ENCRYPTION=TLS(FIPS=N;TRUSTED_CERTIFICATE=rsaroot.crt)"

The following connection string fragment connects to a database server using simple encryption:

"HOST=myhost;SERVER=myserver;ENCRYPTION=simple"

Discuss this page in DocCommentXchange.