-1

I want to encrypt a string using AES encryption in ampscript. I am using EncryptSymmetric function that uses AES algorithm as mentioned in the following documentation : https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/EncryptSymmetric.html.

I only have salt value and IVExternalKey value but not password, and not getting the desired results. Below is the function : EncryptSymmetric(@Email, "AES", "passwordExternalKey", @null, @null, @salt, @null, @IVExternalKey)

Edit: We want to achieve encryption using below steps:

PowerReviews uses a 128-bit AES/CTR/NoPadding cypher, along with the AES alogrithm.

  1. Lowercase the email string.
  2. Encrypt the email using an AES cypher, with the unique 16 digit string provided by PowerReviews as the encryption key and 'XYZ' as the IV.
  3. Convert any '+' characters to '==PLUS==' in the encrypted email string in step 2.
  4. URL encode the string from step 3 using UTF-8 encoding.
  5. Assign the resulting string to the pr_emuid parameter within the Write-a-Review wrapper page URL.
3
  • Hi, i updated my answer with the infos pertaining to encryption, including url encoding. Ampscript has a lowercase() function and a replace() function, this is easy to google. You can do this before encryption if necessary. You cannot use "XYZ" as the IV, it has to conform to SFMC's specs, 32 digits, see my post. You can copy/paste the 16 digit SALT from anywhere into the key management section. Mind you, with URL encoding, replacing "+" is not necessary unless it serves a purpose elsewhere. You can replace my sample parameters from the URL encoded link with your 'pr_emuid' parameters. Jan 11 at 9:26
  • Thanks @JonasLamberty , XYZ was just a sample value. We do have the actual IV and Salt String but we do not have the password external key yet.
    – user110045
    Jan 11 at 13:35
  • Not sure if that is a question; for clarity's sake: you can define the password's External Key yourself, in my example I simply set it to "passwordExternalKey". This is not the password itself. So you can just go to Key management, create a password like "abcdefg", and define its externalKey to "passwordExternalKey" and start testing. You can change "abcdefg" to the real password later with no change in code required. Jan 11 at 15:26
3

You need password, salt and IV. So it cannot work yet.

Create these three things in Setup, Key Management, in the BU where you want to encrypt. And, if separate, create the exact same three things also in the BU where you want to decrypt.

  • Password: Key Type = Symmetric, it is not specified how this should look, so use something with around 25 characters and following standard password security best practices; give it the external key "passwordExternalKey" (basically anything works for external keys, but let's just use this)

  • SALT: Key Type = Salt; exactly 16 characters long, hex string; give it the external key "saltExternalKey" (basically anything works for external keys, but let's just use this)

  • IV: Key Type = Initialization Vector; exactly 32 characters long, hex string; give it the external key "ivExternalKey" (basically anything works for external keys, but let's just use this)

You can generate hex strings of your desired length here: https://www.browserling.com/tools/random-hex

now, your encryption can look like this:

%%[
/* pull in the parameters from key management by the external keys defined above */
SET @pw = "passwordExternalKey"
SET @salt = "saltExternalKey"
SET @IV = "ivExternalKey"
 
/* encrypt some personalization strings (repeat as necessary for other data) */

SET @encryptedSubscriberKey = EncryptSymmetric(_subscriberkey, 'AES', @pw, @null, @salt, @null, @IV, @null)
SET @encryptedEmail = EncryptSymmetric(emailaddr, 'AES', @pw, @null, @salt, @null, @IV, @null)
]%%

You can now output the vars @encryptedSubscriberKey and @encryptedEmail and they contain contain encrypted strings.

You can URLEncode them via

%%=URLEncode(@encryptedSubscriberKey,1,1)=%%

So a final link with them attached could look like:

<a href="https://www.url.com?sk=%%=URLEncode(@EncryptedSubscriberKey,1,1)=%%&e=%%=URLEncode(@EncryptedEmail,1,1)=%%">click</a>

Decryption at the destination then will look like this:

%%[
/* pull in the parameters from key management */
SET @pw = "passwordExternalKey"
SET @salt = "saltExternalKey"
SET @IV = "ivExternalKey"
 
%%[
SET @emailAddress = /* set to the value of @encryptedEmail, however it came here, e.g. get it via RequestParameter */
SET @subscriberKey = /* set to the value of @encryptedSubscriberKey, however  it came here, e.g. get it via RequestParameter */

IF NOT EMPTY(@emailAddress) THEN
    SET @decryptedEmailAddress = DecryptSymmetric(@EmailAddress, 'AES', @pw, @null, @salt, @null, @IV, @null)

IF NOT EMPTY(@subscriberKey) THEN
    SET @decryptedSubscriberKey = DecryptSymmetric(@SubscriberKey, 'AES', @pw, @null, @salt, @null, @IV, @null)
ENDIF
]%%

you can then use the vars @decryptedSubscriberKey and @decryptedEmailAddress and they contain the plain data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.