# Specifying an alternate encryption algorithm

Derby supports the following encryption algorithms.

- DES (the default)
- DESede (also known as triple DES)
- Any encryption algorithm that fulfills the following requirements:
  - It is symmetric
  - It is a block cipher, with a block size of 8 bytes
  - It uses the NoPadding padding scheme
  - Its secret key can be represented as an arbitrary byte array
  - It requires exactly one initialization parameter, an initialization vector of type javax.crypto.spec.IvParameterSpec
  - It can use javax.crypto.spec.SecretKeySpec to represent its key

  For example, the algorithm Blowfish implemented in the Sun JCE package fulfills these requirements.

By Java convention, an encryption algorithm is specified like this:

    algorithmName/feedbackMode/padding

The only feedback modes allowed are:

- CBC
- CFB
- ECB
- OFB

The only padding mode allowed is NoPadding.

By default, Derby uses the DES algorithm of DES/CBC/NoPadding.

To specify an alternate encryption algorithm when you create a database, use the encryptionAlgorithm=algorithm attribute. If the algorithm you specify is not supported by the provider you have specified, Derby throws an exception.

To specify the AES encryption algorithm with a key length other than the default of 128, specify the encryptionKeyLength attribute. For example, you might specify the following connection attributes:

    jdbc:derby:encdbcbc_192;create=true;dataEncryption=true;
    encryptionKeyLength=192;encryptionAlgorithm=AES/CBC/NoPadding;
    bootPassword=Thursday

To use the AES algorithm with a key length of 192 or 256, you must use unrestricted policy jar files for your JRE. You can obtain these files from your Java provider. They might have a name like "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files." If you specify a non-default key length using the default policy jar files, a Java exception occurs.

Parent topic: Creating the boot password
Related concepts
Encrypting databases on creation
Specifying an alternate encryption provider