# Configuring Network Client authentication without SSL/TLS

If you do not encrypt network traffic with SSL/TLS, you can use properties to specify the encryption of user names and passwords on the client side.

Important: Using SSL/TLS is strongly recommended for production applications. Use the properties only under unusual circumstances.

The `securityMechanism=value` property specifies a security mechanism for the Derby Network Client. See the Derby Reference Manual for details on this property.

You can set the `securityMechanism` property in one of the following ways:

- When you are using the `java.sql.DriverManager` class, set `securityMechanism=value` in a `java.util.Properties` object before you invoke the form of the `DriverManager.getConnection` method that includes the `java.util.Properties` parameter.
- When you are using the `ClientDataSource` interface to create and deploy your own DataSource objects, invoke the `ClientDataSource.setSecurityMechanism` method after you create a ClientDataSource object.

The following table lists the security mechanisms that the Derby Network Client supports, and the corresponding property value to specify to obtain this security mechanism. The default security mechanism is the user id only if no password is set. If the password is set, the default security mechanism is both the user id and password. The default user is APP if no other user is specified.

Table 1. Security mechanisms supported by the Derby Network Client
Security Mechanism | securityMechanism Property Value | Comments
--- | --- | ---
User id and password | `ClientDataSource.CLEAR_TEXT_PASSWORD_SECURITY` (0x03) | Default if password is set
User id only | `ClientDataSource.USER_ONLY_SECURITY` (0x04) | Default if password is not set
Encrypted user id and encrypted password | `ClientDataSource.ENCRYPTED_USER_AND_PASSWORD_SECURITY` (0x09) | Encryption requires a JCE implementation that supports the Diffie-Hellman algorithm with a public prime of 256 bits.

Derby provides two ClientDataSource implementations. Use the `org.apache.derby.jdbc.ClientDataSource` class on all supported Java SE versions except Java SE 8 Compact Profile 2. On Java SE 8 Compact Profile 2, use the `org.apache.derby.jdbc.BasicClientDataSource40` class.

Parent topic: Configuring Network Server authentication in special circumstances