Encryption via managed package

Question

In my current project we are trying to redirect a logged in user from a webpage to a salesforce community page with guest user access. We want the community page to recognize the user and so we are sending as an encrypted token(account uuid) as a part of the redirection URL.
A component on the community page takes the token from the url, sends it to the backend where it decrypted and validated.
So to do this, the origin website will have an AES256 key and salesforce will have the same key. I have read that it is very difficult to keep keys protected in salesforce since protected metadata etc. are not protected outside of a managed package.
I know little about managed packages despite having been reading for the last 2 hours.
Here are my questions:

• I am wondering then if I can just create a managed package with the key protected inside this package and the encryption/decryption methods and then from my normal apex code call something like MyNamespace.MyCrypto.MyCrypto.decrypt(token) and I get the content back from the managed package.
• When creating a managed packages one requires Create AppExchange Packages permissions. Once I have uploaded my managed package, it is not suddenly available on appexchange I hope? I only want it inside my own org, not avialable to others.
  
  I have read as much as I can in sf documentation and StackExchange and I tried to test it myself building what I wanted in a trailhead org but it appears that one can not create managed packages from trailhead orgs?
  
  Any help would be much appreciated.
  Dane

Answer 1

I am wondering then if I can just create a managed package with the key protected inside this package and the encryption/decryption methods and then from my normal apex code call something like MyNamespace.MyCrypto.MyCrypto.decrypt(token) and I get the content back from the managed package.

Yes. You can create a Managed Package, create a Custom Setting or Custom Metadata that is Protected, and this data will only be accessible through Apex code that is also in the Managed Package. The functions to use this protected data needs to be written as global in order to be used outside the package, if necessary.

When creating a managed packages one requires Create AppExchange Packages permissions. Once I have uploaded my managed package, it is not suddenly available on appexchange I hope? I only want it inside my own org, not avialable to others.

Posting on the AppExchange requires additional steps, such as creating a Listing and passing a Security Review. Your code won't immediately publish to the AppExchange without your knowledge or consent, as this is a very intentional process.

I have read as much as I can in sf documentation and StackExchange and I tried to test it myself building what I wanted in a trailhead org but it appears that one can not create managed packages from trailhead orgs?

Correct. You need a proper Developer Edition org. If you're a Salesforce Partner, you can do this through the Partner Portal. If not, simply create a new Developer Edition org. They cost nothing, ever, and are ideal for developing Managed Packages or for use as a small Developer Hub org for creating Unlocked Packages or Second Generation Managed Packages.