[ https://issues.redhat.com/browse/JGRP-2274?page=com.atlassian.jira.plugin... ] Nick Sawadsky edited comment on JGRP-2274 at 7/10/20 12:19 PM: --------------------------------------------------------------- [~belaban] To my knowledge the CBC mode of encryption does not provide integrity checking.  GCM does, and I believe it can be enabled in JGroups via: {code:java} sym_algorithm="AES/GCM/NoPadding" sym_iv_length="12"{code} However, GCM has a very strict requirement to avoid reuse of the same IV for a given key, which is difficult to guarantee when a static key is used. As a result I'm still hoping TLS support can eventually be added to address the integrity checking requirement, as well as provide additional protections for cluster traffic. was (Author: nsawadsky): [~belaban] To my knowledge the CBC mode of encryption does not provide integrity checking.  GCM does, and I believe it can be enabled in JGroups via: {code:java} sym_algorithm="AES/GCM/NoPadding" sym_iv_length="12"{code} However, GCM has a very strict requirement to avoid reuse of the same IV for a given key, which is difficult to guarantee when a static key is used. As a result I'm still hoping TLS support can eventually be added to address the integrity checking requirement, as well as provide a generally stronger story around security of cluster traffic. -- This message was sent by Atlassian Jira (v7.13.8#713008)