2

I'm new to Salesforce and working on a problem being raised by my team. They have a requirement to encrypt all PII passing between our systems and Salesforce . Our company only allows for this data to be encrypted using RSA asymmetric key encryption. I am being told that this is not supported by Salesforce. Is this the case?

10
  • RSA / Asymmetric encryption is not typically used for encryption of field level data at rest. I'd be curious to understand what the driver is for wanting to use that instead of symmetric key encryption like AES-256. Sep 3 '19 at 19:50
  • It's honestly a company standard that I have I inherited. The theory is that the data security team does not feel that passing private keys to public cloud providers is secure enough. 😳 Sep 3 '19 at 20:00
  • 1
    Also, you shouldn't need to manually encrypt anything to transfer it securely, you should be using proper https to communicate between your system and Salesforce. Sep 3 '19 at 20:10
  • 2
    I think this requirement is confused or has been communicated to you poorly. I would encourage you to go back to the security team to get clarity on what is exactly required. Transmission security (via HTTPS, typically) is very different from at-rest security (Salesforce Platform Encryption).
    – David Reed
    Sep 3 '19 at 20:33
  • 1
    You can generate your own keys with your HSM, but RSA/asymmetric encryption is not the technology we use to do encryption of data at rest. Since the encrypt/decrypt operations happen solely on the Salesforce platform it doesn't make sense to use asymmetric encryption - symmetric encryption (AES in this case) is more appropriate. Sep 3 '19 at 21:15
1

Salesforce doesn't support asymmetric data encryption at the user level, you can look at the Crypto class to see what is supported in Apex. It isn't supported because there isn't really a use case for it (it does support asymmetric encryption algorithms for signing data, since that is an appropriate use case for asymmetric encryption and not symmetric). Once you've given someone the public key for the data you encrypted, it's effectively irrelevant whether or not you used asymmetric or symmetric encryption for the purpose of keeping the data secret, and symmetric encryption is both secure at smaller key sizes and faster overall due to the smaller size.

Candidly, if your security team doesn't understand the use cases of asymmetric vs symmetric encryption, I'd be very concerned that they are being trusted to secure PII. Your company may want to consider hiring an outside firm to help educate your security team and test your existing implementations.

5
  • Thank you for the great link! Honestly, if you knew who I worked for you may re-consider your confidence. We hold many patents in this area that I guarantee you leverage regularly. :) Sep 5 '19 at 19:30
  • Once you've given someone the public key for the data you encrypted, it's effectively irrelevant whether or not you used asymmetric or symmetric encryption this is completely wrong and misleading. If you encrypt with RSA only the holder of private key can decrypt the data; symmetric algorithm means whoever holds the key used to encrypt can also decrypt.
    – zaitsman
    Mar 5 at 0:22
  • @zaitsman I think you're getting hung up on public v private key, I probably should have just used the words encryption and decryption key. My point is that both types of encryption have at least one key for encryption and at least one for decryption, if you encrypt with one key and give someone else the decryption key they can decrypt it whether or not that's a symmetric or asymmetric key. As an aside, for RSA in particular the private key and public key can both decrypt each other's encrypted data, this is not a requirement for asymmetric systems though. Mar 5 at 14:37
  • Which is why the security of SF is lax, as i do not want SF to be able to decrypt the message intended for my remote service when i did not share private keys with SF.
    – zaitsman
    Mar 5 at 20:13
  • @zaitsman If you have a specific scenario that you're trying to figure out a solution for you can make another question. Mar 5 at 20:38
2

With Salesforce Shield Platform Encryption you can generate your own keys with your HSM and use Bring Your Own Keys (BYOK), but RSA/asymmetric encryption is not the technology we use to do encryption of data at rest. Since the encrypt/decrypt operations happen solely on the Salesforce platform it doesn't make sense to use asymmetric encryption - symmetric encryption (AES in this case) is more appropriate, and is what we use (AES-256).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.