Key Capabilities
- Native AES encryption and decryption of message content, with no external tools or scripts required
- Multiple key sources (password-based key derivation, static key, or header-supplied key) and seven cipher modes
- Configurable nonce/IV handling, GCM authentication, password salt, and padding, with interoperability for content encrypted by OpenSSL
Overview
The AES connector performs native AES encryption and decryption of message content, replacing prior workarounds that required invoking OpenSSL through Script and managing external processes. The connector offers two operations: Encrypt (the default) and Decrypt. You configure how keys, cipher modes, and metadata (such as nonces or IVs and authentication tags) are handled.The connector can decrypt content originally encrypted with OpenSSL (AES-CBC), provided the same key, IV, and padding configuration are used.
Connector Configuration
This section contains all of the configurable connector properties.Settings Tab
The available settings depend on the selected Operation, Key source, and Cipher Mode.Configuration
Settings related to the core operation of the connector. Use the Operation radio buttons to specify whether the connector encrypts (the default) or decrypts message content.Key
Settings related to the AES key. The available fields depend on the selected Key source. The following table shows the settings for Password-Based Key Derivation.Non-Default Key Options
- If you are using a Static Key, provide the Key as hexadecimal (prefixed with
0x) or Base64. The decoded key must be 16, 24, or 32 bytes (AES-128, AES-192, or AES-256). - If you are using a Header-supplied Key, binary values you enter accept hex (
0x) or Base64; binary values the connector generates and writes to headers are Base64-encoded. The decoded key must be 16, 24, or 32 bytes (AES-128, AES-192, or AES-256).
Non-Default Password Salt Options
- If you choose Static in Password Salt, use the Password Salt field to provide a value that decodes to exactly 16 bytes, as
0x-prefixed hexadecimal or Base64. - If you choose Header in Password Salt, enter the name of the message header used to read or write the password salt in the Password Salt Header field.
Cipher
Settings related to the cipher mode and nonce/IV handling.In Decrypt mode, the Nonce / IV Auto-Generate field changes to Included.