I'm trying to decrypt the example that AMPScript has in the documentation https://ampscript.guide/encryptsymmetric/ using Crypto class.

I have desperately tried all the scenarios but I don't know if MKCloud encrypt using AES128, AES192, AES256... no info in the documentation.

Has anyone faced this issue?

How can we decrypt something encrypted from Marketing Cloud with password, salt and IV?

String encAES = '4fKWdv7fJRkFsYO6RRtrMg=='; //Base64 encrypted result in MKCloud
String password = 'fresh'; //Password in Marketing Cloud 
String salt = 'e0cf1267f564b362'; // Salt
String initVector = '4963b7334a46352623252955df21d7f3'; //IV

String saltedHex = salt + EncodingUtil.convertToHex(Blob.valueOf(password));
String saltedHex2 = EncodingUtil.convertToHex(Blob.valueOf(password)) + salt;
Blob saltBlob = EncodingUtil.convertFromHex(saltedHex);
Blob saltBlob2 = EncodingUtil.convertFromHex(saltedHex2);

//Generate MAC all versions
Blob mac = Crypto.generateMac('HmacSHA256', EncodingUtil.convertFromHex(salt), Blob.valueOf(password));
Blob mac2 = Crypto.generateMac('HmacSHA256', Blob.valueOf(password), EncodingUtil.convertFromHex(salt));
Blob mac3 = Crypto.generateMac('HmacSHA256', Blob.valueOf(salt), Blob.valueOf(password));
Blob mac4 = Crypto.generateMac('HmacSHA256', Blob.valueOf(password), Blob.valueOf(salt));

Blob key = Crypto.generateDigest('SHA-256', Blob.valueOf(password + salt));
Blob key2 = Crypto.generateDigest('SHA-256', Blob.valueOf(salt + password));
Blob key3 = Crypto.generateDigest('SHA-256', Blob.valueOf(password));
Blob key4 = Crypto.generateDigest('SHA-256', EncodingUtil.convertFromHex(salt));
Blob key5 = Crypto.generateDigest('SHA-256', saltBlob);
Blob key6 = Crypto.generateDigest('SHA-256', saltBlob2);

//Encrypted b64 / blob
Blob encryptedBlob = EncodingUtil.base64Decode(encAES);

Blob decryptedBlob = Crypto.decrypt('AES256', ¿key/mac? , EncodingUtil.convertFromHex(initVector), encryptedBlob);

String decryptedString = decryptedBlob.toString();

Thanks for you help!!!


1 Answer 1


Finally I found a solution.

MKCloud AMPScript's default AES implementation is based on a 256 bit key size, CBC with 16 byte block size, and PKCS7 with 1000 iterations.

The derived Key generation is based on password and salt with PBKDF2, 1000 iteration, SHA-1 HMac function and 256 length.

Crypto Class cannot generate the Key like AMPScript because the method generateMac can not define the length so HmacSHA1 return 20 bytes instead 32. crypto.generateMac('HmacSHA1', Blob.valueOf(salt), Blob.valueOf(key));

SOLUTION: Use the following tool to generate the key, store it in SF and use it to decrypt https://8gwifi.org/pbkdf.jsp

Master Password - (MKCloud) @password Salt (Base64) - (MKCloud) @salt (Convert from hex to base64 https://base64.guru/converter/encode/hex) dkLen - 256 PBE Ciphers - PBKDF2WithHmacSHA1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .