Keys and secrets
IG uses cryptographic keys for encryption, signing, and securing network connections, and passwords. The following sections describe how to secure keys and secrets in your deployment.
Update cryptography
Different algorithms and methods are discovered and tested over time, and communities of experts decide which are the most secure for different uses. Use up-to-date cryptographic methods and algorithms to generate keys.
| Legacy keystore types such as JKS and JCEKS are supported but are not secure. Consider using the PKCS#12 keystore type. |
Use strong keys
Small keys are easily compromised. Use at least the recommended key size.
In JVM, the default ephemeral Diffie-Hellman (DH) key size is 1024 bits. To
support stronger ephemeral DH keys, and protect against weak keys,
consider setting the following system property to increase the DH key size:
jdk.tls.ephemeralDHKeySize=2048. From Tomcat 8.5.37, the default DH key size
is 2048-bit.
For more information, refer to Customizing size of ephemeral Diffie-Hellman keys
Rotate keys
Rotate keys regularly to:
-
Limit the amount of data protected by a single key.
-
Reduce dependence on specific keys, making it easier to migrate to stronger algorithms.
-
Prepare for when a key is compromised. The first time you try key rotation shouldn’t be during a real-time recovery.
-
Conform to internal business compliance requirements.
For more information, refer to Rotating keys.