3

I need to utilize the encryptsymmetric ampscript function to pass an email through to Commerce Cloud that is encrypted.

The guys on commerce cloud have generated a private and public key. I cannot import the cert. file associated to the public key so, I just copied the txt string and attempted to encrypt the email value but it doesn't appear to be working.

We're also utilizing a SALT and an initial vector with this encrption string.

https://www.sample.com?e=%%=EncryptSymmetric(emailaddr, "AES;mode=ecb;padding=none", 'CC_Public2', @null, 'Sample Salt2', @null, 'initVector', @null)=%%

I can't find this specific process documented anywhere especially when it comes to what type of cert files can be uploaded to asymmetric keys or whether or not a plain text key can be copied into the symmetric key field without being truncated.

Improve this question
4

2 Answers 2

Reset to default
4
+50

Symmetric encryption: only one key is involved. The parties share that key - one party encrypts with the key, the other party decrypts with the same key. Asymmetric encryption - two keys (public and private) are involved. One party encrypts with public key, the other party decrypts with the private key.

EncryptSymmetric is a symmetric encryption function as its name suggests and it cannot use private/public keys generated for asymmetric crypto case.

Commerce Cloud supports both symmetric and asymmetric encryption algorithms, Marketing Cloud (at least in AMPScript) only supports symmetric. You want to do this:

  1. Pick a symmetric cipher. This includes the name of the algorithm and optional mode and padding values (for DES/3DES only)
  2. Generate a symmetric key
  3. Optionally, generate salt and initialization strings. The need to do so depends on the cipher chosen.

Communicate all three items to the other party. The examples in EncryptSymmetric show steps #1 and #3.

To verify encryption / decryption with your keys outside of Salesforce, I recommend cryptii.com . Here's a screenshot of your encryption / decryption pipeline with AES-256 as the cipher and a randomly generated key + initialization vector

encryption / decryption pipeline with AES-256 as the cipher

Improve this answer
2
  • Is this not supported across clouds as stated in this documentation? "Marketing Cloud does not support the use of these functions in conjunction with outside or third-party encryption and decryption functionality." developer.salesforce.com/docs/…
    – Tom Callahan
    Commented Jul 3, 2019 at 2:20
  • 1
    The terms "outside" (of SFMC), "third-party" and "supported" might mean something to e.g. SF product support...but technically speaking, there's no issue per se. You can encrypt/decrypt and send/receive to/from outside. Standard encryption algorithms being used imply that both sides (incl. an outside party) can encrypt/decrypt as long as you adhere to the agreed-upon crypto scheme.
    – identigral
    Commented Jul 3, 2019 at 3:11
1

Only the following file types are allowed for import on Salesforce Commerce Cloud B2C Commerce instance:

  • Trusted certificates: .crt .pem .cer .der
  • Private Keys: .p12 .pfx

Try providing the private key in .p12 or .pfx format to Commerce Cloud.

See https://documentation.b2c.commercecloud.salesforce.com/DOC1/topic/com.demandware.dochelp/WebServices/Importcertificatesforaninstance.html

Improve this answer
1
  • Where this is helpful from an import into Commerce Cloud, it doesn't answer the question since I'm looking to do the opposite. Public Key on SFMC, Private Key on CC.
    – Tom Callahan
    Commented Apr 3, 2019 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .