Encryption

, ,
1

Imported from previous forum

2

[ original email was from Nikhil Bose - assistsoft@yahoo.com ]
Hello,

Sorry to not post this to the "Encryption" forum, but that one seems to be in hibernation. I have a few questions regarding encryption:

  1. What form of ecryption is most popular for FIX messages? DES or PGP-DES-MD5, or something else?

  2. In the security.doc document in the "App Notes" section, it says that SenderCompID and TargetCompID must be encrypted if the message is being encrypted, according to the FIX specification. But the FIX spec seems to say that those header fields may be encrypted. Are the SenderCompID and TargetCompID typically encrypted, and if so, are they also sent unencrypted, or only encrypted?

  3. Again, as the FIX spec recommends, if encryption is being used, all the fields of all messages are encrypted. Is that pretty much the case, or do people encrypt selected fields, to enhance performance? Presumably, encryption and decryption are very slow operations.

Thanks,
Nikhil

3

  1. From my experience and usage, PGP-DES-MD5. Standard DES is still used by some "early" FIX users, but most commercial and proprietary FIX engines which support encryption have PGP-DES-MD5 support from my experience (more than 30 PGP-DES-MD5 encrypted sessions).

  2. The Spec (in the Standard Header message definition) says that SenderCompID and TargetCompID are “Always unencrypted”. The App Note does contradict this. I would recommend following the Spec as to which fields must be unencrypted. I’ll make a note of the opportunity for clarification regarding the App Note.

  3. You should encrypt all of the body of a message. Encrypting the “Can be embedded within the encrypted data section” fields of the Standard Header, do not add very many extra bytes for encryption and thus do not impact crypto performance or “cost” very much (DES works on 8 byte chunks). It’s important to note that PGP has a very high performance cost but is only used for the Logon in PGP-DES-MD5 and subsequent messages are simply using 56 bit DES which is pretty fast on modern hardware and certainly much faster than the intial PGP operation. For instance, router-to-router encryption typically supports DES (and other ciphers) for all TCP traffic. Disclaimer: You should validate the impact on your throughput yourself, though.

> Hello,
>
> Sorry to not post this to the "Encryption" forum, but that one seems to be in hibernation. I have a few questions regarding encryption:
>
> 1) What form of ecryption is most popular for FIX messages? DES or PGP-DES-MD5, or something else?
>
> 2) In the security.doc document in the "App Notes" section, it says that SenderCompID and TargetCompID must be encrypted if the message is being encrypted, according to the FIX specification. But the FIX spec seems to say that those header fields may be encrypted. Are the SenderCompID and TargetCompID typically encrypted, and if so, are they also sent unencrypted, or only encrypted?
>
> 3) Again, as the FIX spec recommends, if encryption is being used, all the fields of all messages are encrypted. Is that pretty much the case, or do people encrypt selected fields, to enhance performance? Presumably, encryption and decryption are very slow operations.
>
> Thanks,
> Nikhil
>
>