Error: Cannot find encryption module (EncRC5). Session will be unencrypted.

Symptoms

Users receive the following error message when connecting with version 7.10.500 of the ICA Client for Macintosh:

“Cannot find encryption module “EncRC5”. Session will be unencrypted.”

Refer to the following screen shot:

Cause

This is by design. Technical limitations prevented RC5 encryption support from being included in version 7.10.500 of the ICA Client for Macintosh.

See CTX112220 – Readme for Citrix Presentation Server Client for Macintosh, Version 10.0.

The following screen shot shows the ICA Client Editor for version 7.0.411 of the client:

The following screen shot shows the ICA Client Editor for version 7.10.500 of the client:

From CTX101910 – Administrator's Guide - Citrix ICA Macintosh Mac OS X Client Version 7.x - English:

“Security Features

• Secure proxy server support. As an alternative to using a SOCKS proxy, the client also supports using a Secure Proxy Server. For more information, see “Configuring the Client to Work with a Proxy Server” on page 57.

• Secure Sockets Layer (SSL) support. SSL provides server authentication, encryption of the data stream, and message integrity checks. See “Integrating the Client with the Secure Gateway for MetaFrame Presentation Server or SSL Relay” on page 59.

• Transport Layer Security encryption. As an alternative to Secure Sockets Layer (SSL) 3.0, the client also supports Transport Layer Security (TLS) 1.0. See “Configuring SSL/TLS” on page 61.

• Encryption. The client supports different levels of encryption, including RSA RC5 encryption. See “Using Encryption” on page 63.

• NDS support. When users launch the client, they can log on and be authenticated using their Novell Directory Services (NDS) credentials. Supported NDS credentials are user name (or distinguished name), password, directory tree, and context.”

From CTX112069 – Citrix Presentation Server Client for Macintosh Administrator's Guide:

Note: Pages 16 and 63-64 from the ICA Client for Macintosh Version 7.x Administrator’s Guide have been removed.

“Security Features

• Support for smart cards. You can use smart cards to provide authenticating credentials when logging on to a server. See page 19 for more information about using smart cards with the client. This feature is available only when connecting to computers running Presentation Server for Windows and not computers running Presentation Server for UNIX. You may also need to install proprietary software to use smart card readers.

• Secure proxy server support. As an alternative to using a SOCKS proxy, the client also supports using a Secure Proxy Server. For more information, see “Configuring the Client to Work with a Proxy Server” on page 49.

• Secure Sockets Layer (SSL) support. SSL provides server authentication, encryption of the data stream, and message integrity checks. See “Integrating the Client with the Secure Gateway or SSL Relay” on page 51.

• Transport Layer Security encryption. As an alternative to Secure Sockets Layer (SSL) 3.0, the client also supports Transport Layer Security (TLS) 1.0. See “Configuring SSL/TLS” on page 52.

• NDS support. When users launch the client, they can log on and be authenticated using their Novell Directory Services (NDS) credentials. Supported NDS credentials are user name (or distinguished name), password, directory tree, and context.”

Resolution

Configure SSL connections. Do not enforce encryption on the published application, the ICA listener, Citrix policies, or Microsoft Windows policies.

The following screen shot shows the encryption setting in a published application:

The following screen shot shows the encryption setting in the ICA listener:

The following screen shot shows the encryption setting in a Citrix policy:

Check if you have a Windows encryption policy in place. To do so, open the Group Policy Editor and go to Computer Configuration > Administrative Templates > Windows Components > Terminal Services > Encryption and Security.
For the encryption level, the most restrictive policy between Microsoft and the settings in the Citrix connection configuration is enforced.

Workaround

Investigate the use of the PowerPC version 7.00.411 ICA Macintosh Client.

More Information

CTX104904 – Error: You Do Not Have The Proper Encryption Level.. When Logging On To a Windows 2003 Server

Status

Citrix is currently considering the possibility of reinstituting the RC5 encryption feature in later builds of the ICA Client for Macintosh on Intel platforms. This article will be updated when new information is obtained.