Update ABL cryptography code to use FIPS mode
- Last Updated: February 11, 2026
- 1 minute read
- OpenEdge
- Version 13.0
- Documentation
To use FIPS mode, you must change your application code to use functions, methods, and attributes that use algorithms approved by the National Institute of Standards and Technology (NIST). Here are the basic code changes:
- Replace use of the ENCODE function with the GENERATE-PASSWORD-HASH function.
GENERATE-PASSWORD-HASHrequires that you select a NIST-approved algorithm and a salt value. - Replace the algorithm specified in the ENCRYPT and DECRYPT functions with a NIST-approved algorithm, if necessary.
- Replace the algorithm specified in the SECURITY-POLICY:PBE-HASH-ALGORITHM attribute with a NIST-approved algorithm, if necessary.
- Replace the algorithm specified in the SECURITY-POLICY:SYMMETRIC-ENCRYPTION-ALGORITHM attribute with a NIST-approved algorithm, if necessary.
- If using the
GENERATE-PBE-KEYfunction, set thePBE-ALGORITHMattribute toPBKDF2and use a salt value that is 16-512 bytes in size.Note: You will need to regenerate stored PBE keys. - Discontinue use of the MD5-DIGEST function and SHA1-DIGEST function.
- Replace the algorithm specified in the MESSAGE-DIGEST function with a NIST-approved algorithm, if encrypted.
- Replace use of the
AUDIT-POLICY:ENCRYPT-AUDIT-MAC-KEY()method with the SECURITY-POLICY:ENCODE-PASSWORD() method.
Important: You will also need to manually convert your data to
approved ciphers before enabling FIPS Mode in your OpenEdge environment, if you are
using non-NIST-approved algorithms.