I'm using the Crypto class but want to leverage the built-in Master Encryption Key store instead of saving my own AES keys somewhere in the database. Is it possible to get access to the Master Encryption Key via Apex so it can be used to encrypt/decrypt data?

Also, is it possible to access encrypted fields (Classic and Shield) in Apex?

2 Answers 2

  1. Access to master keys from Apex with Classic encryption - no. You can only manage Shield keys from Apex and even then it's only via the REST API.

  2. Access to encrypted fields in Apex - yes, with some caveats. In both Classic and Shield, reading the encrypted value in Apex does what you'd expect (it gives you the plaintext value). Classic is a lot easier to deal with if you can live with what it provides. Shield is more enterprise-grade but also much more intrusive.

  • Sadly, that is what I was expecting. Are there any best practices you've run across storing keys to use with Crypto in Classic?
    – Shanerk
    Commented Apr 4, 2019 at 18:38
  • Best practice is to generate random keys and store them in a protected custom setting or custom metadata. developer.salesforce.com/page/Secure_Coding_Storing_Secrets
    – identigral
    Commented Apr 4, 2019 at 19:01
  • Right, but it still isn't great since anyone who gets access to the db can proceed to decrypt everything given they have the key as well as the encrypted data.
    – Shanerk
    Commented Apr 4, 2019 at 19:34
  • Shield encryption solves for that use case (encryption at rest with your own keys)
    – identigral
    Commented Apr 4, 2019 at 19:38

The accepted answer is 5 years old.

According to this article, it should be possible.

Implementation notes snippet :

Encrypted fields are encrypted with 128-bit master keys and use the Advanced Encryption Standard (AES) algorithm. You can archive, delete, and import your master encryption key. To enable master encryption key management, contact Salesforce.

  • Unfortunately, using platform-managed (Cert and Key Mgmt) symmetric keys in Apex is still not possible.
    – identigral
    Commented Jul 4 at 16:38
  • luckily I copied out the snippet, the article seems to have changed...
    – compski
    Commented Jul 5 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .