How to "see" encrypted attribute values (for verification)

Question

Hi,
I have enabled attribute encryption following:
http://docs.sun.com/app/docs/doc/819-0995/6n3cq3aqc?a=view
I configured an attribute named "xx-attribute1" to be encrypted:
C:\SunDS\ds6\bin>dsconf create-encrypted-attr verbose -h foo.whatever.com secure-port 636 dc=orwhatever,dc=com axx-attribute1 des3
Certificate "XXXXXXXXXXXXXXXXXXXXXXXX" presented by the server is not trusted.
Type "Y" to accept, "y" to accept just once, "n" to refuse, "d" for more details
: Y
Enter "cn=Directory Manager" password:
Creating the encrypted attribute "dc=orwhatever,dc=com" for "xx-attribute1"...
Data have to be imported to have attribute encrypted on "dc=orwhatever,dc=com".
The "create-encrypted-attr" operation succeeded on "foo.whatever.com:636".
and then I used dsconf to check that the change "took":
C:\SunDS\ds6\bin>dsconf list-encrypted-attrs -h foo.whatever.com --secure-port 636 dc=orwhatever,dc=com
Enter "cn=Directory Manager" password:
xx-attribute1
So, that part looks ok.
I then used dscc to add an "xx-attribute1" to one of my users.
I would like to actually "see" the encrypted attribute somewhere, just to verify that the value that I entered using dscc was, in fact, encrypted, i.e., something like:
{des3}xxxxxxxxxxxxxxxxx
I've looked through the files in the "data" directory for this suffix, but I can't find anything that looks like that.
Is there any way to "see" that?
To be clear, I know that I won't be able to decrypt the encrypted value. I just want to verify, somehow, that SunDS is encrypting data that I'm entering.
Thanks,
Jim

Answer 1

Hi,
I think I was able to find the encrypted attribute in xxx_id2entry.db3:
xx-attribute1: {ckm_des3_cbc}wsRrq1ygL8cnQOXSuu2dAz+1w==
so, it looks like the encryption is working :).
Jim