Imported from previous forum
[ original email was from Yizhaq Pinhas - zak@mintco.com ]
Hi all,
According to the specification of the FIX protocol in all versions, the TargetCompID and SenderCompID fields should NOT be encrypted (FIX Spec 4.2 p. 16).
But, in the FIX APPLICATION NOTE - Security Protocol, it specifically says that these fields should be encrypted, as well as Sequence number and other fields.
What should be the right way to that?
Is there anybody with encryption experience who could answer that?
Thanx,
Zak Pinhas
Sungard Business Integration.
[ original email was from Ryan Pierce - rpierce@taltrade.com ]
> Hi all,
> According to the specification of the FIX protocol in all versions, the TargetCompID and SenderCompID fields should NOT be encrypted (FIX Spec 4.2 p. 16).
>
> But, in the FIX APPLICATION NOTE - Security Protocol, it specifically says that these fields should be encrypted, as well as Sequence number and other fields.
>
> What should be the right way to that?
> Is there anybody with encryption experience who could answer that?
TargetCompID and SenderCompID must appear in plaintext in the FIX message header.
However, there’s no reason why one couldn’t also include them in the encrypted data as well.
[ original email was from Anand Kumar - anand.kumar@nssmb.com ]
Probably the question is not that if we can include TargetCompID and SenderCompID in encrypted text or not, it is that : shall we include it in clear text or in the encrypted text. The application note is misleading, it specifically says : "some fields that must always be sent encrypted when encryption is enabled. These fields are: Sending Time, Sequence Number, Poss Dup Flag, SenderCompID, and TargetCompID. . By always sending these fields encrypted, an attacker is prevented from capturing FIX messages and replaying them at a later time to the same destination or to another destination altogether."
This sounds completely wrong. Actually these fields MUST be there in the clear text to that the receipient can authenticate the sender.
> > Hi all,
> > According to the specification of the FIX protocol in all versions, the TargetCompID and SenderCompID fields should NOT be encrypted (FIX Spec 4.2 p. 16).
> >
> > But, in the FIX APPLICATION NOTE - Security Protocol, it specifically says that these fields should be encrypted, as well as Sequence number and other fields.
> >
> > What should be the right way to that?
> > Is there anybody with encryption experience who could answer that?
>
> TargetCompID and SenderCompID must appear in plaintext in the FIX message header.
>
> However, there’s no reason why one couldn’t also include them in the encrypted data as well.
>
Please refer to the FIX specification’s section for “Standard Message Header” and “Standard Message Trailer”. These rules are clearly stated there. TargetCompID and SenderCompID both state “always unencrypted”.
> Probably the question is not that if we can include TargetCompID and SenderCompID in encrypted text or not, it is that : shall we include it in clear text or in the encrypted text. The application note is misleading, it specifically says : “some fields that must always be sent encrypted when encryption is enabled. These fields are: Sending Time, Sequence Number, Poss Dup Flag, SenderCompID, and TargetCompID. . By always sending these fields encrypted, an attacker is prevented from capturing FIX messages and replaying them at a later time to the same destination or to another destination altogether.”
> This sounds completely wrong. Actually these fields MUST be there in the clear text to that the receipient can authenticate the sender.
>
> > > Hi all,
> > > According to the specification of the FIX protocol in all versions, the TargetCompID and SenderCompID fields should NOT be encrypted (FIX Spec 4.2 p. 16).
> > >
> > > But, in the FIX APPLICATION NOTE - Security Protocol, it specifically says that these fields should be encrypted, as well as Sequence number and other fields.
> > >
> > > What should be the right way to that?
> > > Is there anybody with encryption experience who could answer that?
> >
> > TargetCompID and SenderCompID must appear in plaintext in the FIX message header.
> >
> > However, there’s no reason why one couldn’t also include them in the encrypted data as well.
> >
>