Do Not Use Encryption Algorithms that are Not Secure

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Check that you are not using an outdated algorithm (like 3DES) by looking at the configuration settings.

How it is fixed

Fix method: Guidance or infrastructure patch

To determine what encryption options used to encrypt the database you can run the following command: db2 => get db cfg | grep -i encrypt Encryption Library for Backup (ENCRLIB) = libdb2encr.so Encryption Options for Backup (ENCROPTS) = CIPHER=AES:MODE=CBC:KEY LENGTH=256 Encrypted database = YES ENCROPTS should not contain CIPHER=3DES algorithm, because 3DES is not secure. CIPHER=AES is secure. You can also check the current database encryption settings: db2 => SELECT * FROM TABLE(SYSPROC.ADMIN_GET_ENCRYPTION_INFO()) You must be connected to the database to run this command. From the information retrieved, the ALGORITHM should not be 3DES.