Password Storage Encryption in Okta
Last Updated:
Overview
Okta secures user data and passwords using bcrypt hashing with a high number of iterations. Additionally, Okta employs 2048-bit RSA key pairs and 256-bit symmetric keys with Advanced Encryption Standard (AES) ciphers to encrypt data at rest and secure communications.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Password Encryption
- Security
Solution
How does Okta encrypt and store passwords and user data?
Okta hashes passwords using bcrypt with a high number of iterations. Okta segments user data, including usernames and passwords, by the context of the organization parameter. During organization creation, Okta generates a programmatic organization-level key store consisting of a 2048-bit RSA public/private key pair and a 256-bit symmetric key.
The 2048-bit RSA key pair encrypts and signs Security Assertion Markup Language (SAML) assertions that Okta performs to downstream Software as a Service (SaaS) applications on behalf of users and their associated organizations. These key pairs generate the X.509 certificate for a specific organization.
The symmetric key uses an Advanced Encryption Standard (AES) cipher to encrypt user data at rest within the Okta databases. The strongest cipher available for the length of the organization's symmetric key determines the encryption strength. For example, a 256-bit symmetric key results in AES-256 encryption.
Transport Layer Security (TLS) 1.2 or higher encrypts access to the Okta Web Application. Internally generated secret keys, referred to as primary keys, protect the organization's keys and X.509 certificate and reside in the Okta key management database.
