The only restrictions on the encryption and decryption scheme you choose are as follows:
You should bear in mind that the routine is called on entry to the resource definition maintenance functions and at every attempt to sign on to MSS. A slow scheme can, therefore, result in poor performance.