AES Connector

The AES connector provides native AES encryption and decryption of message content directly within CData Arc.

Key Capabilities

Native AES encryption and decryption of message content, with no external tools or scripts required
Multiple key sources (password-based key derivation, static key, or header-supplied key) and seven cipher modes
Configurable nonce/IV handling, GCM authentication, password salt, and padding, with interoperability for content encrypted by OpenSSL

Overview

The AES connector performs native AES encryption and decryption of message content, replacing prior workarounds that required invoking OpenSSL through ArcScript and managing external processes. The connector offers two operations: Encrypt (the default) and Decrypt. You configure how keys, cipher modes, and metadata (such as nonces or IVs and authentication tags) are handled.

The connector can decrypt content originally encrypted with OpenSSL (AES-CBC), provided the same key, IV, and padding configuration are used.

Passwords, keys, and sensitive header values are masked in all logs, message details, audit records, debug output, errors, and support packages. In addition, authentication failures never return partially decrypted content.

Connector Configuration

This section contains all of the configurable connector properties.

Settings Tab

The available settings depend on the selected Operation, Key source, and Cipher Mode.

Configuration

Settings related to the core operation of the connector.

Setting	Description
Connector Id	The static, unique identifier for the connector.
Connector Type	Displays the connector name and a description of what it does.
Connector Description	An optional field to provide a free-form description of the connector and its role in the flow.

Use the Operation radio buttons to specify whether the connector encrypts (the default) or decrypts message content.

Key

Settings related to the AES key. The available fields depend on the selected Key source. The following table shows the settings for Password-Based Key Derivation.

Setting	Description
Key	How the AES key is provided: Password-Based Key Derivation (default), Static (a fixed key entered in the settings), or a key read from a message Header.
Password	The password used to derive the AES key. Interpreted as UTF-8.
Key Size (Bits)	The size of the derived AES key in bits: 128, 192, or 256 (default).
Key Derivation Function	The PBKDF2 pseudorandom function used to derive the AES key: PBKDF2-HMAC-SHA256 or PBKDF2-HMAC-SHA512.
Iterations	The number of PBKDF2 iterations. Higher values increase resistance to brute-force attacks at the cost of performance. The default is `600000`.
Password Salt	How the PBKDF2 salt is provided: Auto-Generate (default), a static value, or read from a message header.
Generated Salt Output	(auto-generated salt) Whether the generated salt is Included in the payload or written to an output header.

Non-Default Key Options

If you are using a Static Key, provide the Key as hexadecimal (prefixed with 0x) or Base64. The decoded key must be 16, 24, or 32 bytes (AES-128, AES-192, or AES-256).
If you are using a Header-supplied Key, binary values you enter accept hex (0x) or Base64; binary values the connector generates and writes to headers are Base64-encoded. The decoded key must be 16, 24, or 32 bytes (AES-128, AES-192, or AES-256).

Non-Default Password Salt Options

If you choose Static in Password Salt, use the Password Salt field to provide a value that decodes to exactly 16 bytes, as 0x-prefixed hexadecimal or Base64.
If you choose Header in Password Salt, enter the name of the message header used to read or write the password salt in the Password Salt Header field.

Cipher

Settings related to the cipher mode and nonce/IV handling.

Setting	Description
Cipher Mode	The AES cipher mode: GCM, CBC, ECB, CFB, OFB, CTS, or CTR. GCM is the default, and is recommended because it provides both confidentiality and authentication. ECB is provided only for legacy compatibility. The other options provide confidentiality, but not authentication.
Padding Mode	(CBC and ECB modes only) The padding scheme: PKCS7 (default), Zeros, None, ANSIX923, or ISO10126.
Nonce / IV	How the nonce or IV is provided: Auto-Generate (default; a unique nonce or IV is generated for each encryption), Static, or Header. GCM uses a 12-byte nonce; the other modes use a 16-byte IV. ECB does not use a nonce or IV. Selecting Static displays a warning that reusing a static nonce or IV with the same key is insecure for GCM and weakens the other modes. If you select Header, supply the header name.
Generated Nonce / IV Output	(Auto-Generate only) Whether the generated nonce/IV is Included in the payload or written to an output Header.

In Decrypt mode, the Nonce / IV Auto-Generate field changes to Included.

Authentication

GCM cipher mode only.

Setting	Description
Authentication Tag	Whether the GCM authentication tag is Included in the payload or written to an output Header.
Authentication Tag Length (Bits)	The authentication tag length in bits: 128 (the default), 120, 112, 104, or 96. 128 is recommended; shorter tags reduce authentication strength and should be used only for interoperability.
Additional Authenticated Data	Optional Additional Authenticated Data (AAD): None (default), or read from a message Header.
Additional Authenticated Data Header	The name of the message header used to read the AAD. A value beginning with `0x` is decoded as hexadecimal; otherwise it is interpreted as UTF-8.

Advanced Tab

Advanced Settings

Settings not included in the previous categories.

Setting	Description
Processing Delay	The amount of time (in seconds) by which the processing of files placed in the Transactions tab is delayed. This is a legacy setting. Best practice is to use a File connector to manage local file systems instead of this setting.
Local File Scheme	A scheme for assigning filenames to messages that are output by the connector. You can use macros in your filenames dynamically to include information such as identifiers and timestamps. For more information, see Macros.

Logging

Settings that govern the creation and storage of logs.

Setting	Description
Log Level	The verbosity of logs generated by the connector. When you request support, set this to Debug.
Log Subfolder Scheme	Instructs the connector to group files in the Logs folder according to the selected interval. The Weekly option (which is the default) instructs the connector to create a new subfolder each week and store all logs for the week in that folder. Leaving this setting blank tells the connector to save all logs directly in the Logs folder. For connectors that process many transactions, using subfolders helps keep logs organized and improves performance.
Log Messages	Check this to have the log entry for a processed file include a copy of the file itself. If you disable this, you might not be able to download a copy of the file from the Transactions tab.

Miscellaneous

Miscellaneous settings are for specific use cases.

Setting	Description
Other Settings	Enables you to configure hidden connector settings in a semicolon-separated list (for example, `setting1=value1;setting2=value2`). Normal connector use cases and functionality should not require the use of these settings.

Automation Tab

Settings

Settings related to the automatic processing of files by the connector.

Setting	Description
Send Automation	Whether messages arriving at the connector are automatically processed.

Performance

Settings related to the allocation of resources to the connector.

Setting	Description
Max Workers	The maximum number of worker threads consumed from the threadpool to process files on this connector. If set, this overrides the default setting on the Performance Settings portion of the Advanced Settings page.
Max Files	The maximum number of files sent by each thread assigned to the connector. If set, this overrides the default setting on the Performance Settings portion of the Advanced Settings page.

Alerts Tab

SLAs Tab

Included Payload Format

When metadata is included in the payload, the connector orders the fields as follows, omitting any field that is not configured:

salt || nonce/IV || ciphertext || authentication tag

Default Header Names

When keys or metadata are read from or written to message headers, the connector uses these default header names:

Purpose	Default header
Password Salt	`Crypto-Password-Salt`
AES Key	`Crypto-Key`
Nonce / IV	`Crypto-Nonce`
Auth Tag	`Crypto-Auth-Tag`
AAD	`Crypto-AAD`

Getting Started

Flows

EDI Trading Partner Management Console

Connectors

Mapping

APIs and Automation

How-To Guides

Scripting

Software License and Third-Party Copyrights

Key Capabilities

Overview

Connector Configuration

Settings Tab

Configuration

Key

Non-Default Key Options

Non-Default Password Salt Options

Cipher

Authentication

Advanced Tab

Advanced Settings

Logging

Miscellaneous

Automation Tab

Settings

Performance

Alerts Tab

SLAs Tab

Included Payload Format

Default Header Names

Macros

Examples

​Key Capabilities

​Overview

​Connector Configuration

​Settings Tab

​Configuration

​Key

Non-Default Key Options

Non-Default Password Salt Options

​Cipher

​Authentication

​Advanced Tab

​Advanced Settings

​Logging

​Miscellaneous

​Automation Tab

​Settings

​Performance

​Alerts Tab

​SLAs Tab

​Included Payload Format

​Default Header Names

​Macros

​Examples

Key Capabilities

Overview

Connector Configuration

Settings Tab

Configuration

Key

Cipher

Authentication

Advanced Tab

Advanced Settings

Logging

Miscellaneous

Automation Tab

Settings

Performance

Alerts Tab

SLAs Tab

Included Payload Format

Default Header Names

Macros

Examples