Enabling Unlimited Strength Cryptography in ColdFusion

March 08, 2012
coldfusionjava

If you want to use very strong encryption in ColdFusion you may need to install the Unlimited Strength Jurisdiction Policy Files in the JVM running ColdFusion.

For example if you want to use AES encryption with anything higher than a 128 bit key, then you need to do this otherwise you will get an exception about invalid key length when you try to encrypt or decrypt.

But - Pete? you ask, how do I use a higher key bit length with AES encryption in ColdFusion? Instead of GenerateSecretKey("AES") use this: GenerateSecretKey("AES", 256)

You my also be thinking what if I don't use the Encrypt or Decrypt functions - should I still do this? My answer here would be Yes. Other techonologies such as HTTPS can use AES 256 encryption, without this policy a cfhttp call can only use 128 bit encryption even if the server supports 256 bit SSL (note I haven't done any tests to back this up, I am assuming that is the case).

Now if you do your development on a Mac you might find that AES 256 works just fine without doing anything. The JVM that apple ships appears to have unlimited crypto enabled (at least if you live in the US it does - may differ depending on your locale).

Ok - how do I enable it?

First, head over to oracle and download the Java 1.7 policy files or java 1.6 policy files (depending on what version of java you are running).

Next locate the JVM directory that ColdFusion is using. If you are at this point sayings what's a JVM I never installed a JVM, then you are probably using the JVM that ships with ColdFusion, which on windows might be located at c:\ColdFusion9\runtime\jre\ here's how to find out for sure:

  • Login to ColdFusion Administrator
  • Click on Settings Summary on the left under the Server Settings
  • Look for Java Home under the JVM Details heading

Now you will want to place the two jar files local_policy.jar and US_export_policy.jar under the lib/security/ folder. If the files already exist copy them into a temp directory for backup, then replace with the ones you just downloaded. Restart ColdFusion, and you're done.

Upgrade your JVM to at least 1.6.0_24

Now is probably a good time to upgrade your JVM if you are running a 1.6 version lower than 1.6.0_24 - because without doing so you are leaving your server open to a serious DOS vulnerability. Adobe has certified and supports Java 1.6.0_24 for all versions of ColdFusion 8 and 9 (more info on the JVM DOS vulnerability here)



Related Entries

3 people found this page useful, what do you think?

Comments

Thanks Pete! I would very much like to see asymmetric cryptography supported in some way. That is the encryption key exposed in CF can't be used to decrypt the data. That way we can safely embed our key on the server, while keeping the decryption key private off-site.

-Brian
I agree it would be nice to have something builtin to handle Asymmetric encryption in ColdFusion, but you can always leverage Java from your cfml to do this.

Post a Comment




  



Spell Checker by Foundeo

Recent Entries



foundeo


did you hack my cf?