Enabling Unlimited Strength Cryptography in ColdFusion
If you want to use very strong encryption in ColdFusion you may need to install the Unlimited Strength Jurisdiction Policy Files in the JVM running ColdFusion.
For example if you want to use AES encryption with anything higher than a 128 bit key, then you need to do this otherwise you will get an exception about invalid key length when you try to encrypt or decrypt.
But - Pete? you ask, how do I use a higher key bit length with AES encryption in ColdFusion? Instead of
GenerateSecretKey("AES") use this:
You my also be thinking what if I don't use the Encrypt or Decrypt functions - should I still do this? My answer here would be Yes. Other techonologies such as HTTPS can use AES 256 encryption, without this policy a cfhttp call can only use 128 bit encryption even if the server supports 256 bit SSL (note I haven't done any tests to back this up, I am assuming that is the case).
Now if you do your development on a Mac you might find that AES 256 works just fine without doing anything. The JVM that apple ships appears to have unlimited crypto enabled (at least if you live in the US it does - may differ depending on your locale).
Ok - how do I enable it?
As of Java 1.8.0_151 and Java 9 Oracle has a new, somewhat easier way to enable Unlimited Strength Crypto. Please use the instructions in that link.
Here are the old outdated instructions...
Note you really should not be following these instructions, because doing so means you have a JVM with security vulnerabilities, should you really be doing this type of crypto with a vulnerable JVM?
Next locate the JVM directory that ColdFusion is using. If you are at this point sayings what's a JVM I never installed a JVM, then you are probably using the JVM that ships with ColdFusion, which on windows might be located at
c:\ColdFusion9\runtime\jre\ here's how to find out for sure:
- Login to ColdFusion Administrator
- Click on Settings Summary on the left under the Server Settings
- Look for Java Home under the JVM Details heading
Now you will want to place the two jar files
US_export_policy.jar under the
lib/security/ folder. If the files already exist copy them into a temp directory for backup, then replace with the ones you just downloaded. Restart ColdFusion, and you're done.
Upgrade your JVM to at least 1.6.0_24
Now is probably a good time to upgrade your JVM if you are running a 1.6 version lower than 1.6.0_24 - because without doing so you are leaving your server open to a serious DOS vulnerability. Adobe has certified and supports Java 1.6.0_24 for all versions of ColdFusion 8 and 9 (more info on the JVM DOS vulnerability here)
- Updating Java on ColdFusion or Lucee - March 21, 2019
- Java Unlimited Strength Crypto Policy for Java 9 or 1.8.0_151 - October 19, 2017
- Getting Size of Heap and Non Heap Memory in CFML - July 17, 2013
- Adobe Says Go Ahead and Upgrade your ColdFusion JVM - October 24, 2012
- What's New in Java 7? - January 18, 2011
- Updating Java on ColdFusion or Lucee
- ColdFusion returning empty response with server-error: true
- Careful applying CF11u16, CF2016u8, CF2018u2
- Sessions don't work in Chrome but do in IE
- csrfVerifyToken does not invalidate the token
- The cf_sql_ is optional in cfqueryparam
- Cookie Expires / Max-Age 1969-12-31T23:59:59.000Z
- Burst Throttling on AWS API Gateway Explained