You probably read RSA two-factor authentication, not encryption.
As far as encryption goes, it out of the box uses PBEWITHSHA256AND256BITAES-CBC-BC policy which means password-based encryption using SHA-256 for hash digesting (used for storing authentication credential password) and 256-bit AES for symmetric encryption with cipher block chaining (used for storing password data), both generally best practices today for these types of use cases. But if that's not what you like, you can plug in your own implementation.