Enabling Unlimited Strength Cryptography in ColdFusion
If you want to use very strong encryption in ColdFusion you may need to install the Unlimited Strength Jurisdiction Policy Files in the JVM running ColdFusion.
For example if you want to use AES encryption with anything higher than a 128 bit key, then you need to do this otherwise you will get an exception about invalid key length when you try to encrypt or decrypt.
But - Pete? you ask, how do I use a higher key bit length with AES encryption in ColdFusion? Instead of
GenerateSecretKey("AES") use this:
You my also be thinking what if I don't use the Encrypt or Decrypt functions - should I still do this? My answer here would be Yes. Other techonologies such as HTTPS can use AES 256 encryption, without this policy a cfhttp call can only use 128 bit encryption even if the server supports 256 bit SSL (note I haven't done any tests to back this up, I am assuming that is the case).
Now if you do your development on a Mac you might find that AES 256 works just fine without doing anything. The JVM that apple ships appears to have unlimited crypto enabled (at least if you live in the US it does - may differ depending on your locale).
Ok - how do I enable it?
Next locate the JVM directory that ColdFusion is using. If you are at this point sayings what's a JVM I never installed a JVM, then you are probably using the JVM that ships with ColdFusion, which on windows might be located at
c:\ColdFusion9\runtime\jre\ here's how to find out for sure:
- Login to ColdFusion Administrator
- Click on Settings Summary on the left under the Server Settings
- Look for Java Home under the JVM Details heading
Now you will want to place the two jar files
US_export_policy.jar under the
lib/security/ folder. If the files already exist copy them into a temp directory for backup, then replace with the ones you just downloaded. Restart ColdFusion, and you're done.
Upgrade your JVM to at least 1.6.0_24
Now is probably a good time to upgrade your JVM if you are running a 1.6 version lower than 1.6.0_24 - because without doing so you are leaving your server open to a serious DOS vulnerability. Adobe has certified and supports Java 1.6.0_24 for all versions of ColdFusion 8 and 9 (more info on the JVM DOS vulnerability here)
- Getting Size of Heap and Non Heap Memory in CFML - July 17, 2013
- Adobe Says Go Ahead and Upgrade your ColdFusion JVM - October 24, 2012
- What's New in Java 7? - January 18, 2011
- OutOfMemoryError - GC overhead limit exceeded - March 25, 2010
- Bea JRockit 5 JVM Released - February 22, 2005
- CFSummit 2016 Slides
- Securing Legacy CFML - dev.Objective() 2016 Slides
- My CFSummit 2015 Slide Decks
- Adding Chrome Custom Search for CFDocs
- Disable Flash Remoting on ColdFusion Servers
- HackMyCF Adds SSL/TLS Scanner
- IncompatibleClassChangeError after ColdFusion 11 Update 5
- Scope Injection in CFML