Issue
Information is requested on whether Security Expert supports AES-256 encryption for operator login passwords and whether these credentials are stored in the SQL Server database using AES-256 encryption.
Product Line
EcoStruxure Security Expert
Environment
- Security Expert
- Microsoft Active Directory
- Microsoft SQL Server
Cause
There is an assumption that operator passwords should be stored using AES-256 encryption, whereas Security Expert instead uses hashing for local authentication and defers password storage to Active Directory when integrated.
Resolution
When using Security Expert native authorization for operator logins, operator passwords are processed using a hashing mechanism before being stored in the SQL database, ensuring they are not stored in a readable format. AES-256 encryption is not used for password storage.
When Active Directory (AD) authorization is used, Security Expert does not store operator passwords. Only the operator username is stored, and all password encryption and storage are managed by Windows Active Directory.
AES-256 encryption is supported for communication between readers, controllers, and the server, but not for operator password storage. For encryption details within Active Directory, refer to Microsoft Windows documentation.
