AES Connector

The AES connector provides native AES encryption and decryption of message content directly within CData Arc.

Key Capabilities

Native AES encryption and decryption of message content, with no external tools or scripts required
Multiple key sources (password-based key derivation, static key, or header-supplied key) and seven cipher modes
Configurable nonce/IV handling, GCM authentication, password salt, and padding, with interoperability for content encrypted by OpenSSL

Overview

The AES connector performs native AES encryption and decryption of message content, replacing prior workarounds that required invoking OpenSSL through ArcScript and managing external processes. The connector offers two operations: Encrypt (the default) and Decrypt. You configure how keys, cipher modes, and metadata (such as nonces or IVs and authentication tags) are handled.

The connector can decrypt content originally encrypted with OpenSSL (AES-CBC), provided the same key, IV, and padding configuration are used.

Passwords, keys, and sensitive header values are masked in all logs, message details, audit records, debug output, errors, and support packages. In addition, authentication failures never return partially decrypted content.

Connector Configuration

This section contains all of the configurable connector properties.

Settings Tab

The available settings depend on the selected Operation, Key source, and Cipher Mode.

Configuration

Settings related to the core operation of the connector.

設定	説明
Connector Id	コネクタの静的で一意の識別子です。
Connector Type	コネクタ名とその機能の説明を表示します。
Connector Description	コネクタおよびフロー内でのその役割について自由形式の説明を提供するためのオプションフィールドです。

Use the Operation radio buttons to specify whether the connector encrypts (the default) or decrypts message content.

Key

Settings related to the AES key. The available fields depend on the selected Key source. The following table shows the settings for Password-Based Key Derivation.

Setting	Description
Key	How the AES key is provided: Password-Based Key Derivation (default), Static (a fixed key entered in the settings), or a key read from a message Header.
Password	The password used to derive the AES key. Interpreted as UTF-8.
Key Size (Bits)	The size of the derived AES key in bits: 128, 192, or 256 (default).
Key Derivation Function	The PBKDF2 pseudorandom function used to derive the AES key: PBKDF2-HMAC-SHA256 or PBKDF2-HMAC-SHA512.
Iterations	The number of PBKDF2 iterations. Higher values increase resistance to brute-force attacks at the cost of performance. The default is `600000`.
Password Salt	How the PBKDF2 salt is provided: Auto-Generate (default), a static value, or read from a message header.
Generated Salt Output	(auto-generated salt) Whether the generated salt is Included in the payload or written to an output header.

Non-Default Key Options

If you are using a Static Key, provide the Key as hexadecimal (prefixed with 0x) or Base64. The decoded key must be 16, 24, or 32 bytes (AES-128, AES-192, or AES-256).
If you are using a Header-supplied Key, binary values you enter accept hex (0x) or Base64; binary values the connector generates and writes to headers are Base64-encoded. The decoded key must be 16, 24, or 32 bytes (AES-128, AES-192, or AES-256).

Non-Default Password Salt Options

If you choose Static in Password Salt, use the Password Salt field to provide a value that decodes to exactly 16 bytes, as 0x-prefixed hexadecimal or Base64.
If you choose Header in Password Salt, enter the name of the message header used to read or write the password salt in the Password Salt Header field.

Cipher

Settings related to the cipher mode and nonce/IV handling.

Setting	Description
Cipher Mode	The AES cipher mode: GCM, CBC, ECB, CFB, OFB, CTS, or CTR. GCM is the default, and is recommended because it provides both confidentiality and authentication. ECB is provided only for legacy compatibility. The other options provide confidentiality, but not authentication.
Padding Mode	(CBC and ECB modes only) The padding scheme: PKCS7 (default), Zeros, None, ANSIX923, or ISO10126.
Nonce / IV	How the nonce or IV is provided: Auto-Generate (default; a unique nonce or IV is generated for each encryption), Static, or Header. GCM uses a 12-byte nonce; the other modes use a 16-byte IV. ECB does not use a nonce or IV. Selecting Static displays a warning that reusing a static nonce or IV with the same key is insecure for GCM and weakens the other modes. If you select Header, supply the header name.
Generated Nonce / IV Output	(Auto-Generate only) Whether the generated nonce/IV is Included in the payload or written to an output Header.

In Decrypt mode, the Nonce / IV Auto-Generate field changes to Included.

Authentication

GCM cipher mode only.

Setting	Description
Authentication Tag	Whether the GCM authentication tag is Included in the payload or written to an output Header.
Authentication Tag Length (Bits)	The authentication tag length in bits: 128 (the default), 120, 112, 104, or 96. 128 is recommended; shorter tags reduce authentication strength and should be used only for interoperability.
Additional Authenticated Data	Optional Additional Authenticated Data (AAD): None (default), or read from a message Header.
Additional Authenticated Data Header	The name of the message header used to read the AAD. A value beginning with `0x` is decoded as hexadecimal; otherwise it is interpreted as UTF-8.

Advanced Tab

Advanced Settings

Settings not included in the previous categories.

Setting	Description
Processing Delay	The amount of time (in seconds) by which the processing of files placed in the Transactions tab is delayed. This is a legacy setting. Best practice is to use a File connector to manage local file systems instead of this setting.
Local File Scheme	A scheme for assigning filenames to messages that are output by the connector. You can use macros in your filenames dynamically to include information such as identifiers and timestamps. For more information, see Macros.

Logging

ログの作成と保存を制御する設定です。

設定	説明
Log Level	コネクタが生成するログの詳細度です。サポートを依頼する際は、これをDebug に設定してください。
Log Subfolder Scheme	選択した間隔に従って、コネクタがLogs フォルダ内のファイルをグループ化するよう指示します。Weekly オプション（デフォルト）は、コネクタが毎週新しいサブフォルダを作成し、その週のすべてのログをそのフォルダに保存するよう指示します。この設定を空白のままにすると、コネクタはすべてのログをLogs フォルダに直接保存します。多数のトランザクションを処理するコネクタでは、サブフォルダを使用することでログを整理しやすくなり、パフォーマンスが向上します。
Log Messages	処理したファイルのログエントリにファイル自体のコピーを含めるには、これをオンにします。これを無効にすると、Transactions タブからファイルのコピーをダウンロードできなくなる場合があります。

Miscellaneous

Miscellaneous 設定は、特定のユースケース向けの設定です。

設定	説明
Other Settings	非表示のコネクタ設定をセミコロン区切りのリストで設定できます（例：`setting1=value1;setting2=value2`）。通常のコネクタのユースケースや機能では、これらの設定の使用は必要ありません。

Automation Tab

Settings

Settings related to the automatic processing of files by the connector.

Setting	Description
Send Automation	Whether messages arriving at the connector are automatically processed.

Performance

コネクタへのリソースの割り当てに関する設定です。

設定	説明
Max Workers	このコネクタでファイルを処理するためにスレッドプールから消費されるワーカースレッドの最大数です。設定すると、Advanced Settings ページのPerformance Settings 部分にあるデフォルト設定が上書きされます。
Max Files	コネクタに割り当てられた各スレッドが送信するファイルの最大数です。設定すると、Advanced Settings ページのPerformance Settings 部分にあるデフォルト設定が上書きされます。

Alerts Tab

SLAs Tab

Included Payload Format

When metadata is included in the payload, the connector orders the fields as follows, omitting any field that is not configured:

salt || nonce/IV || ciphertext || authentication tag

Default Header Names

When keys or metadata are read from or written to message headers, the connector uses these default header names:

Purpose	Default header
Password Salt	`Crypto-Password-Salt`
AES Key	`Crypto-Key`
Nonce / IV	`Crypto-Nonce`
Auth Tag	`Crypto-Auth-Tag`
AAD	`Crypto-AAD`

はじめに

フロー

EDI トレーディングパートナー管理コンソール

コネクタ

マッピング

API と自動化

ハウツーガイド

スクリプティング

ソフトウェアライセンスとサードパーティ著作権

Key Capabilities

Overview

Connector Configuration

Settings Tab

Configuration

Key

Non-Default Key Options

Non-Default Password Salt Options

Cipher

Authentication

Advanced Tab

Advanced Settings

Logging

Miscellaneous

Automation Tab

Settings

Performance

Alerts Tab

SLAs Tab

Included Payload Format

Default Header Names

Macros

Examples

​Key Capabilities

​Overview

​Connector Configuration

​Settings Tab

​Configuration

​Key

Non-Default Key Options

Non-Default Password Salt Options

​Cipher

​Authentication

​Advanced Tab

​Advanced Settings

​Logging

​Miscellaneous

​Automation Tab

​Settings

​Performance

​Alerts Tab

​SLAs Tab

​Included Payload Format

​Default Header Names

​Macros

​Examples

Key Capabilities

Overview

Connector Configuration

Settings Tab

Configuration

Key

Cipher

Authentication

Advanced Tab

Advanced Settings

Logging

Miscellaneous

Automation Tab

Settings

Performance

Alerts Tab

SLAs Tab

Included Payload Format

Default Header Names

Macros

Examples