# Supported algorithms for encryption and decryption **URL:** \ **Category:** Apigee\ **Tags:** api-runtime\ **Created:** [March 17, 2019, 4:18am UTC](https://discuss.google.dev/t/supported-algorithms-for-encryption-and-decryption/1648 "2019-03-17T04:18:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\ **Post date:** [March 17, 2019, 4:18am UTC](https://discuss.google.dev/t/supported-algorithms-for-encryption-and-decryption/1648/1 "2019-03-17T04:18:27Z")
Hi, What all algorithms are supported by Apigee for encryption and decryption of data? Thanks, Anup Rai ---
**Author:** ![dchiesa1](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/dchiesa1/32/15641_2.png) [@dchiesa1](https://discuss.google.dev/u/dchiesa1)\ **Post date:** [March 19, 2019, 4:52pm UTC](https://discuss.google.dev/t/supported-algorithms-for-encryption-and-decryption/1648/2 "2019-03-19T16:52:59Z")
Can you be more specific about what data you are talking about? ---
**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\ **Post date:** [March 19, 2019, 5:57pm UTC](https://discuss.google.dev/t/supported-algorithms-for-encryption-and-decryption/1648/3 "2019-03-19T17:57:33Z")
[@Dino-at-Google](https://community.apigee.com/users/8595/dchiesa-1.html) We need to encrypt the message payload, so wanted to know what all algorithms are supported by Apigee for this. I saw [this](https://community.apigee.com/articles/24824/aes-encryption-or-decryption-within-an-apigee-edge.html) link in which encryption was done using AES. Is there any other Algorithm supported? ---
**Author:** ![dchiesa1](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/dchiesa1/32/15641_2.png) [@dchiesa1](https://discuss.google.dev/u/dchiesa1)\ **Post date:** [March 20, 2019, 12:51pm UTC](https://discuss.google.dev/t/supported-algorithms-for-encryption-and-decryption/1648/4 "2019-03-20T12:51:39Z")
If you are encrypting the Message payload, there are many options. First, you should use TLS between the client and the Apigee Edge endpoint. This provides transport-level security including encryption of the communication. After the message arrives at your Apigee Edge API Proxy, it’s unencrypted. Your api proxy logic runs in the “message layer”, which is above the Transport layer. The transport has completed and your API proxy sees the message plaintext. At this point if you would like the API Proxy to encrypt the message you have options. - AES encryption as you found - RSA or public/private key encryption - Any other algorithm supported by Java - Blowfish, DES, 3DES… - There are also some special cases like encrypted JWT, and XML Encryption. Search on community and you will find links for same. I have never produced an example showing how to do RSA encryption of payloads in a Java callout. It’s nothing novel or exotic. It would work the same way, basically, as AES, except you’d use a different crypto in the Java code. UPDATE: I have produced such an example. [See here](https://github.com/DinoChiesa/ApigeeEdge-CustomPolicy-RsaCrypto). The key thing is, on the other side… the upstream… whatever is receiving the message, you need to implement the decryptor. AES is pretty easy and well supported. If you’re choosing, that seems a safe bet. RSA is slow for cryptographic operations. Because of that, most practical uses of RSA for encryption of payloads larger than ~214 bytes ([practical block size for RSA crypto with OAEP padding](https://crypto.stackexchange.com/a/32694/31193)) actually employ a hybrid encryption. Basically: For encryption: auto-generate a symmetric AES key, and AES-encrypt the payload with that, and then RSA-encrypt the AES key with the RSA Public Key. Concatenate the two ciphertexts to the receiver. For decryption, the receiver splits the two ciphertexts (based on length), then uses the RSA Private key to decrypt the AES key from the first part, and uses the resulting AES key to decrypt the second part, to receive the original plaintext payload. ---
**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\ **Post date:** [March 20, 2019, 2:22pm UTC](https://discuss.google.dev/t/supported-algorithms-for-encryption-and-decryption/1648/5 "2019-03-20T14:22:23Z")
Thanks [@Dino-at-Google](https://community.apigee.com/users/8595/dchiesa-1.html) ---
**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\ **Post date:** [February 26, 2020, 1:02pm UTC](https://discuss.google.dev/t/supported-algorithms-for-encryption-and-decryption/1648/6 "2020-02-26T13:02:14Z")
Hi Dino, does apigee has a list which mentions what cipher are used on Apigee to encrypt the request while sending it to target? E.g - - TLS1.2-AES-128-SHA256 One of my provider sent me a list of ciphers they will support, I have their certificate added in the Keystore, but can’t see if we can determined the cipher algorithm used. ---
**Author:** ![dchiesa1](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/dchiesa1/32/15641_2.png) [@dchiesa1](https://discuss.google.dev/u/dchiesa1)\ **Post date:** [August 11, 2020, 4:21am UTC](https://discuss.google.dev/t/supported-algorithms-for-encryption-and-decryption/1648/7 "2020-08-11T04:21:32Z")
Update: See support for [encrypted JWT](https://community.apigee.com/articles/86125/generating-and-verifying-encrypted-jwt-in-apigee.html), now available.