Hello,
adding the two lines to nuxeo.conf is the generic way to implement binary encryption, but it is the least flexible, since encryption is applied to all binaries without exception. This causes problems if there are already "plain" binaries, or if you don't want to encrypt all future binaries.
In this case, you will need to define BlobDispatchers and BlobProviders. I recommend you to read the following: https://doc.nuxeo.com/nxdoc/file-storage/
When you do something with a document (like creating it or download it), the BlobManager will decide what to do. The BlobManager will evaluate the conditions over all the BlobDispatchers, and it will select the desired BlobProvider. For example, you can use a custom property to encrypt binaries:
<extension target="org.nuxeo.ecm.core.blob.DocumentBlobManager" point="configuration">
<blobdispatcher>
<class>org.nuxeo.ecm.core.blob.DefaultBlobDispatcher</class>
<property name="custom:encrypted=true">encrypted</property>
<property name="default">default</property>
</blobdispatcher>
</extension>
In the "name" inside the "property" tag you put the condition that must be true in order to use that BlobProvider. Remember not to forget the "default" BlobDispatcher pointing to the "default" BlobProvider! And then just define the BlobProvider:
<extension target="org.nuxeo.ecm.core.blob.BlobManager" point="configuration">
<blobprovider name="encrypted">
<class>org.nuxeo.ecm.core.blob.binary.AESBinaryManager</class>
<property name="key">password=secret</property>
</blobprovider>
</extension>
I hope it helps!
Regards.
