SQL & ColdFusion Encryption

views:

answers:

+5 Q:

SQL & ColdFusion Encryption

Hi, I know how to encrypt data using ColdFusion using AES_128. I also know how to encrypt data using MSSQL AES_128. Does anyone know if it’s possible to encrypt data in ColdFusion using AES_128, then decrypt the string in MSSQL?

I’ve played around with it a lot and can’t seem to figure it out.

Thanks, Paul

+1 A:

Yes this is possible. There is nothing about AES that makes it proprietary. However, there are many ways of implementing a block cipher, and most of them are incorrect. MS SQL's encryptbykey() uses ECB mode and defaults to ANSI_PADDING. I would try decrypting a message using the same key with an AES in ECB mode and it will likely just work. CBC mode should be used, but this requires a IV, and encryptbykey() doesn't accept an IV as a parameter so its ECB mode. (MySQL also ecb mode, i've looked at the code. Its a shame I can't do that with MS SQL).

Rook 2010-09-08 19:26:53

I am using the encryptbykey() method already. I'm able to encrypt and decrypt the string in SQL however I think the issue that I'm having is that MSSQL using a Symmetric key to encrypt and decrypt the data and the server-side language I'm using (which is ColdFusion) also requires a key however I am unable to replicate that key in ColdFusion because as far as I know you can't actually view the contents of the Symmetric key correct? I've tried using the Symmetric key's gui_key but this didn't work.

Paul 2010-09-09 13:01:49

@Paul aes is a symmetric cipher. gui_key() is a string2key function and has nothing to do with symmetry, its actually a message digest. You could use another string2key function, or randomly generate a key and there for you wouldn't need a string2key function.

Rook 2010-09-09 16:34:07

ansaurus

tags:

views:

answers:

SQL & ColdFusion Encryption

related questions