Encryption Model

Default Settings for Over-the-Wire Encryption

Over-the-wire encryption protects data while in transit. The following table describes initial support:

Over-the-Wire Encryption and Encoding
Content and Context	Algorithm	Configuration
Password in transit when a user logs on to a SAS desktop application	AES¹	NETENCRALG option in the metadata server's invocation command.
Password in transit when a user connects directly to the OLAP server (for example, from a SAS data provider)	AES¹	NETENCRALG option in the server's invocation command.
Password in transit when a user connects to the metadata server from a Base SAS session	AES¹	NETENCRALG option in the server's invocation command. Can be affected by the METAENCRYPTALG option in the client session.
Password in transit when a client retrieves a stored password from the metadata	SASProprietary	RETURNPASSWORDS option in the metadata server's omaconfig.xml file. If you have SAS/SECURE, you can upgrade to AES. See How to Increase Encryption Strength for Outbound Passwords in Transit.
Password in transit when a client sends a password to the metadata for storage	SASProprietary	Not configurable.
Other data in transit to and from SAS servers	None	CEL object server parameter.
Data (including passwords) in transit between a Web browser and a Web application server	None	See the SAS Intelligence Platform: Web Application Administration Guide.
1 If you don't have SAS/SECURE, SASProprietary is used.

	About SAS/SECURE
	Encryption Strength and Coverage
	Default Settings for On-Disk Encryption
	How to Change Over-the-Wire Encryption Settings for SAS Servers