I have this example (in java) for decrypting a message (server-to-server integration), but I'm not able to transform this to Apex.

    // Data from configuration
    String keyFromConfiguration = "000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f";

    // Data from server
    String ivFromHttpHeader = "000000000000000000000000";
    String authTagFromHttpHeader = "CE573FB7A41AB78E743180DC83FF09BD";
    String httpBody = "0A3471C72D9BE49A8520F79C66BBD9A12FF9";

    // Convert data to process
    byte[] key = DatatypeConverter.parseHexBinary(keyFromConfiguration);
    byte[] iv = DatatypeConverter.parseHexBinary(ivFromHttpHeader);
    byte[] authTag = DatatypeConverter.parseHexBinary(authTagFromHttpHeader);
    byte[] encryptedText = DatatypeConverter.parseHexBinary(httpBody);

    // Unlike other programming language, We have to append auth tag at the end of encrypted text in Java
    byte[] cipherText = ArrayUtils.addAll(encryptedText, authTag);

    // Prepare decryption
    SecretKeySpec keySpec = new SecretKeySpec(key, 0, 32, "AES");
    Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
    cipher.init(Cipher.DECRYPT_MODE, keySpec, new IvParameterSpec(iv));

    // Decrypt
    byte[] bytes = cipher.doFinal(cipherText);
    System.out.println(new String(bytes, Charsets.UTF_8));

Probably because Salesforce doesn't include GCM mode but just CBC (https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_classes_restful_crypto.htm#apex_System_Crypto_decrypt).

Has anyone been able to use this method? Any workaround?

  • @identigral That post is from 2019. Therefore the question would be to know if there was a change in the meantime that enables decoding through Apex
    – Rui Silva
    Mar 14, 2023 at 10:38
  • No, Apex is still unable to do this.
    – Derek F
    Mar 14, 2023 at 14:39


Browse other questions tagged .