websphere liberty password identification if encoded with custom aes key or default key

Hi Team,

 From 26.0.0.3 custom aes key implementation is enforced.

https://openliberty.io/blog/2025/12/02/25.0.0.12.html#aes256

https://www.ibm.com/docs/en/was-liberty/base?topic=slia-supplying-your-own-aes-256-key-password-encryption

 Now as earlier with idea we requested providing an mechanism to identify if the password if its is encrypted with aes128 or not.

(https://cloud-platform.ideas.ibm.com/ideas/LIBERTY-I-208)

 Similarly here we request an introduction of providing an param introduced in the securityUtility command to identify if the password was encrypted with AES256 custom key or default key of product.

 There is no identification available by just looking at the server.xml in the liberty configurations to tell if the password is encrypted with custom aeskey or default key when we have 100’s of passwords and 100’s of applications running.

 Logs for reference

com.ibm.ws.crypto.util.PasswordCipherUtil checkAndLogDefaultKeyWarning CWWKS1865W: One or more of your AES-encrypted passwords were encrypted without a custom encryption key. To improve the security of your stored credentials, re-encrypt them by using a custom encryption key. Be sure to store this key in a secure location.

How it should work

Please provide an option or an param introduced in securityutility command itself to check and provide and result if password is encrypted with Custom AESkey or defaultAESkey by executing.

 Benefits

It will be beneficial to everyone if we the param is introduced via securityutility command as from the logs its difficult to identify the passwords which are already encrypted and looking at the server.xml we cannot identify too.

Thanks

Kiran