Could anyone describe what sort of encryption mechanism Salesforce uses when encrypting answers to security questions and also the passwords for user accounts? Is this AES256?
Any help will be appreciated. Also, if someone could provide any documentation on this, it will help.
Salesforce uses a number of security enhancements, some of which will only be released to people after signing an NDA. We do know that passwords are not stored in the database. Instead, a one-way hash is computed from the inputted password, which is then encrypted before being stored in the database. Session IDs are encrypted twice using an algorithm that will only be disclosed under NDA. Security answers are also presumably one-way hashed as well. There is no way to recover a password or security answer from the hashes. Session IDs are decrypted with each call to the server for validation.
Salesforce describes its ISO 270001 security level as follows, in respect to passwords encryption...
All passwords are stored in MD-5 hash format.
