I'm using the Crypto class but want to leverage the built-in Master Encryption Key store instead of saving my own AES keys somewhere in the database. Is it possible to get access to the Master Encryption Key via Apex so it can be used to encrypt/decrypt data?

Also, is it possible to access encrypted fields (Classic and Shield) in Apex?

1 Answer 1

  1. Access to master keys from Apex with Classic encryption - no. You can only manage Shield keys from Apex and even then it's only via the REST API.

  2. Access to encrypted fields in Apex - yes, with some caveats. In both Classic and Shield, reading the encrypted value in Apex does what you'd expect (it gives you the plaintext value). Classic is a lot easier to deal with if you can live with what it provides. Shield is more enterprise-grade but also much more intrusive.

  • Sadly, that is what I was expecting. Are there any best practices you've run across storing keys to use with Crypto in Classic?
    – Shane K
    Apr 4, 2019 at 18:38
  • Best practice is to generate random keys and store them in a protected custom setting or custom metadata. developer.salesforce.com/page/Secure_Coding_Storing_Secrets
    – identigral
    Apr 4, 2019 at 19:01
  • Right, but it still isn't great since anyone who gets access to the db can proceed to decrypt everything given they have the key as well as the encrypted data.
    – Shane K
    Apr 4, 2019 at 19:34
  • Shield encryption solves for that use case (encryption at rest with your own keys)
    – identigral
    Apr 4, 2019 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.