Tag 98 EncryptMethod Logon

1

Currently Tag 98 EncryptMethod in the Logon message has these values:

0=None / Other
1=PKCS (Proprietary)
2=DES (ECB Mode)
3=PKCS / DES (Proprietary)
4=PGP / DES (Defunct)
5=PGP / DES-MD5 (See app note on FIX web site)
6=PEM / DES-MD5 (see app note on FIX web site)

Is it possible to add 7=HMAC/SHA-256?

2

The short answer is yes it is possible. The longer answer is that we have discouraged encryption of application messages in favor of securing the session layer. Also, the original FIX specification (looking now at FIX.4.4 specification) provides quite a bit of latitude on how encryption is implemented.

Some notes:

  1. It is assumed that the encrypted data will be carried in the SecureData(tag 91) and SecureDataLen(Tag 90) fields only.
  2. Certain fields explicitly identified are to be left unencrypted, including EncryptMethod(tag 98).
  3. The maintainers of the standard allowed counterparties to agree on which fields in the message would be encrypted and carried in the SecureData(tag 91) field. However, the standard does recommend that all fields, except those explicitly identified as being required to be transmitted unencrypted, should be encrypted when encryption is employed (see bolded portion of specification excerpt below).
  4. Likely many FIX engine vendors made implementation assumptions on how to implement encryption so if the EncryptMethod is specified, likely any use of a subset of fields or new encryption type will cause breakage at the FIX engine level.

We have an active Cyber Security Working Group, I would suggest that this request and the planned usage be discussed with that group before moving forward with an implementation.

Excerpt from Page 4 of volume 2 of the FIX.4.4 specification (Version 4.4 with Errata 20030618) Encryption:
_ The exchange of sensitive data across public carrier networks may make it advisable to employ data encryption techniques to mask the application messages._
_ The choice of encryption method will be determined by mutual agreement of the two parties involved in the connection._
_ Any field within a message can be encrypted and included in the SecureData field, however, certain explicitly identified fields must be transmitted unencrypted. The clear (unencrypted) fields can be repeated within the SecureData field to serve as an integrity check of the clear data._
_ When encryption is employed, it is recommended but not required that all fields within the message body be encrypted. If repeating groups are used within a message and encryption is applied to part of the repeating group, then the entire repeating group must be encrypted. _
_ Embedded in the protocol are fields, which enable the implementation of a public key signature and encryption methodology, straight DES encryption and clear text. The previously agreed upon encryption methodology is declared in the Logon message. (For more detail on implementation of various encryption techniques see the application notes section on the FIX Web Site.)_

3

Thanks Jim, I didn’t realize it was for encoding the entire application message

We are using encryption only for the password by using these tags:

EncryptedPassword (1402)
EncryptedPasswordLen (1401)
EncryptedPasswordMethid (1402)
EncodedTextLen (354)
EncodedText (355)

I thought that Tag 98 should also indicate which encryption method is being used for the password but apparently not