> For the complete documentation index, see [llms.txt](https://docs.editran.onesait.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.editran.onesait.com/documentacion-editran/ibm-editran-v5.3-ims-en/operacion/anexo-c.-sistema-de-criptografia-en-onesait-editran.md). # Appendix C. Cryptography system in Onesait Editran In the application there is a cryptographic operating mode, corresponding to Cryptographic Version 3.0 and 4.0. This mode uses cryptographic keys that are not exchanged by Editran. The keys will be exchanged between the users. The possible alternatives are: * DES symmetric keys, externally exchanged by the users, which allow triple DES (TD3C) encryption of the data. * Public and private keys using the RSA algorithm, externally exchanged, which support electronic signature of transmissions and: * triple DES (TD3C) encryption of the data. Cryptographic Version 3.0. * AES encryption of the data, with single, double or triple key (for version 5.2 or higher). Cryptographic Version 4.0. ## Cryptographic system parameterization The labels or tags are provided by a Key Interface or are directly referenced in the session Profile. The authentication algorithm can be DES or RSA. * With this parameterization, data is encrypted at load time (Batch) with Exchange Keys obtained externally to Editran and with triple DES data encryption algorithm, the parameters to be coded would be the following:


	Editran
CRYPTOGRAPHY	S
CRYPTOGRAPHIC VERSION	3.0
DATA ENCRYPTION ALGORITHM	TD3C
AUTHENTICATION ALGORITHM	DES
LOCAL SUBSYSTEM
REMOTE SUBSYSTEM
LOC. KEY	Label of the local key
REM. KEY	Label of the remote key

* With this parameterization, data is encrypted at load time (Batch) with RSA Keys, provided by the Editran interface, and with triple DES data encryption algorithm, the parameters to be coded would be the following:


	Editran
CRYPTOGRAPHY	S
CRYPTOGRAPHIC VERSION	3.0/4.0
DATA ENCRYPTION ALGORITHM	TD3C
AUTHENTICATION ALGORITHM	RSA
LOCAL SUBSYSTEM	Subsystem for the association of Editran/GC own keys Ex: H
REMOTE SUBSYSTEM	Subsystem for the association of external Editran/GC keys Ex: P
LOC. KEY
REM. KEY

* With this parameterization, data is encrypted at load time (Batch) with AES data encryption algorithm and RSA keys, provided by the Editran interface, the parameters to be coded would be the following:


	Editran
CRYPTOGRAPHY	S
CRYPTOGRAPHIC VERSION	4.0
DATA ENCRYPTION ALGORITHM	AES1 / AES2 / AES3
AUTHENTICATION ALGORITHM	RSA
LOCAL SUBSYSTEM	Subsystem for the association of Editran/GC own keys Ex: H
REMOTE SUBSYSTEM	Subsystem for the association of external Editran/GC keys Ex: P
LOC. KEY
REM. KEY

## Encryption errors When a Cryptographic Error occurs, the application gives local information about the error produced and sends to the remote side a release request with the reason for the error, later releasing the connection. At the end where the error occurs, the Return Code returned by the product that provides the cryptographic services (ICSF) is reported, so if it occurs, the Return-Code and/or Reason-Code references should be consulted in the product manual: ICSF "z/OS. Cryptographic Services. Integrated Cryptographic Service Facility. Application Programmer's Guide". Likewise, the Editran modules that access the ICSF group these Cryptographic Errors as follows:


	Editran ENCRYPTION ERRORS
999	ERROR OBTAINING PUBLIC KEY
998	ERROR GENERATING SYMMETRIC KEY
997	ERROR GENERATING KEY PAIR
996	ERROR SIGNING
995	ERROR VERIFYING SIGNATURE
994	ERROR OBTAINING SYMMETRIC KEY
993	ERROR SETTING OPERATIONAL KEY
992	ERROR CREATING RSA KEY TOKEN
991	ERROR IMPORTING RSA PAIR
990	ERROR IMPORTING RSA PUBLIC KEY
989	ERROR EXPORTING SYMMETRIC KEY
988	ERROR CALCULATING HASH
900	ERROR GENERATING RANDOM NUMBER
901	ERROR ENCRYPTING
902	ERROR DECRYPTING
801	ERROR CREATING RECORD IN PKDS
802	ERROR DELETING RECORD IN PKDS
803	ERROR READING RECORD IN PKDS
804	ERROR WRITING RECORD IN PKDS

The Editran reasons for the Cryptographic Errors that may occur are the following. ### Cryptographic errors v3.0/ v4.0 RSA or DES * (1): An error occurred when obtaining the local key, either because it was not supplied in Profiles or because of an error in the Key Interface. * (2): When attempting to send an association request or a response, an error occurs generating the uncertainty or the signature. If the algorithm used is DES, the error is in the local key. If it is RSA, the error is in the local key when the signature is generated, or in the remote key when the uncertainty is generated. * (3): Error while attempting to generate the session key. If the algorithm used is DES, the error concerns the local key. If it is RSA, the erroneous key is the remote one. * (4): An error occurred when obtaining the remote key, either because it was not supplied in Profiles or because an error occurred in the Key Interface. * (5): When processing a request or a response from the remote side, an error occurs when attempting to decrypt the uncertainty or the signature. If the DES algorithm is used, the erroneous key is the remote key. If RSA is used, the error is in the remote key when decrypting the signature, or in the local key when decrypting the uncertainty. * (6): When processing a request or a response from the remote side, an error occurs when decrypting the session key. If the algorithm is DES, the error is in the remote key. If it is RSA, the key in error is the local one. * (7): The end that is going to send a user data or Operator Message has had an error in the "online" encryption. * (8): The end that receives a user data or Operator Message from the remote side has had an error in the "online" decryption. * (9): When processing a request or a response, the session key and signature are decrypted, but either the uncertainty does not match or the signature does not match (this case only in RSA). > The error occurs because the exchange keys do not match at both ends. > > If a Key Interface was used, the message must include the last 8 bytes of the label used. > > If the algorithm used is DES, the erroneous key is the local key of the end that generates the message. If it is RSA, the erroneous key is the local key (if an error occurs when validating the uncertainty) or the remote key (if an error occurs when verifying the signature). *** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.editran.onesait.com/documentacion-editran/ibm-editran-v5.3-ims-en/operacion/anexo-c.-sistema-de-criptografia-en-onesait-editran.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.