23

You Should use this String shasign = EncodingUtil.convertToHex(Crypto.generateDigest('SHA1',Blob.valueOf(Your String))); Clarification -: base64Encode will simply convert a Blob to an unencoded String representing its normal form. It will not encode the blob in any form just simply return the String. Whereas convertToHex will return a hexadecimal (base ...


19

The below wiki gives good set of examples for crypto classes http://wiki.developerforce.com/page/Apex_Crypto_Class A sample scenario from above article // Generate an AES key for the purpose of this sample. // Normally this key should be stored in a protected custom setting // or an encrypted field on a custom object Blob cryptoKey = Crypto.generateAesKey(...


14

It can be done through apex execution, not through SOQL: for (Schema.SObjectType object_i : Schema.getGlobalDescribe().values()) { for (Schema.SObjectField field_i : object_i.getDescribe().fields.getMap().values()) { if (field_i.getDescribe().isEncrypted()) { system.debug(object_i.getDescribe().name + ': ' + field_i.getDescribe()....


13

Finally got it working: public class CryptoExample { public static void test(){ CryptoExample.aes128(); CryptoExample.aes192(); CryptoExample.aes256(); } public static void aes128(){ //text to encrypt String clearText = 'the quick brown fox jumps over the lazy dog'; //16 byte string. since characters used are ascii, each char is 1 ...


12

I encrypted a few PII fields on Contact: and ran this script to insert and then query back 200 Contacts: delete [select Id from Contact where createddate = TODAY]; /* test cost of encryption */ Contact[] newContacts = new list<Contact>(); for (Integer i = 0; i < 200; i++) newContacts.add(new Contact( FirstName = 'Fred_'+i, ...


8

You can use SandboxPostCopy interface that allows you run an Apex class as soon as sandbox is refreshed. Use that class to run a batch class that makes your data encrypted. I have implemented similar for my project you can refer that public class SanboxRefreshAnononimyser implements Database.Batchable<sObject>,SandboxPostCopy { public void ...


7

My understanding is that it will not impact apps built using the Mobile SDK 3.0 as it already supports SHA-256 in its libraries. However, you still need devices/ browsers meet the compatibility criteria for SHA-256. You can find more details here.


7

It is expected that you should be able to see it. From Classic Encryption for Custom Fields: Encrypted field data is not always masked in the debug log. Encrypted field data is masked if the Apex request originates from an Apex Web service, a trigger, a workflow, an inline Visualforce page (a page embedded in a page layout), or a Visualforce email ...


7

At least as of V42, you are out-of-luck. The V42 Metadata API does not provide any support for the distinction between probabilistic encryption (introduced in V34) and deterministic encryption (introduced in V42 - beta) Inspecting the CustomField metadata API object, we have: encrypted boolean Note This page is about Shield Platform Encryption, ...


7

TDE is, as EazyE also mentions, a paid feature. You should reach out to your Account Executive to have it enabled, but it will come at a price. Do observe, if you accept the cost, it might not be straightforward to enable. Is your environment on a shared DB, you will be assigned a new MID. Only if you are on a dedicated DB, TDE should be possible to apply ...


7

David is absolutely right and I'd like to add some extra information and provide code examples regarding Apex-encryption/C#-decryption. To encrypt some String in Apex using the AES256-CBC algorithm you can: Generate private key: final Blob privateKey = Crypto.generateAesKey(256); Store somewhere the generated key as a String: // System.debug(LoggingLevel....


6

The following code works in my org. Blob key = Crypto.generateAesKey(256); Blob source = Blob.valueOf('Hello World'); Blob encrypted = Crypto.encryptWithManagedIV('AES256', key, source); String encrypted64 = EncodingUtil.base64Encode(encrypted); Blob dest = EncodingUtil.base64Decode(encrypted64); Blob decrypted = Crypto.decryptWithManagedIv('AES256', key, ...


6

As @DerekF pointed out in his comment, you are conflating Hashing and Encryption. SHA-512 is the 512-bit digest version of the SHA-2 hashing function. Per Wikipedia, a cryptographic hashing function, is a mathematical algorithm that maps data of arbitrary size (often called the "message") to a bit array of a fixed size (the "hash value"...


5

String.fromCharArray is going to create a UTF-8 encoded string, which will alter the bytes in the stream. For example, 242 will be encoded as two bytes instead of one. Any value outside 0-127 will be encoded as multiple bytes when using this function, including all negative integers. Since we can't really work with binary data directly in Apex Code, just ...


5

Modify the controller to be the following and encrypted data will be supported. Note: This can easily be supported with dynamic queries and sObject describes to be scalable, however, due to the length of my utilities class, it does not make sense to post here, but to only provide the method for which to ensure that encrypted values are not returned to end ...


5

I have decrypted SFMC encrypted strings in C# outside of the platform. Credit for the method goes to Pato Sapir on Github for his et-encrypt-decrypt solution. You should be able to decrypt the string outside of the platform with the code referenced above if you use parameters like this in your AMPScript: %%=EncryptSymmetric("test","des;mode=ecb;padding=...


5

Maximum length of text encrypted field is 175. Salesforce just shows incorrect error message you can read it here Are limited to 175 characters because of the encryption algorithm.


5

BUT can I rely on it ? Is there a possibility that 2 records with different keys would generate the same hash ? Yes, there is. There must be, because you're compressing more than 256 bits of data down to 256 bits, so there must be some nonunitary number of inputs that map to each hash output. Given a perfect hash algorithm, the probability would be 1 in 2^...


5

Deterministic Encryption considerations doc is pretty clear on this for compound fields like Contact.Name (Account.Name is not a compound field) Compound Fields Even with deterministic encryption, some kinds of searches don’t work when data is encrypted with case-sensitive deterministic encryption. Concatenated values, such as compound names, aren’t the ...


5

Here's what I use in SSJS. You'd need to use your own password, vector and salt, obviously. Encrypt function encryptString(decStr) { Variable.SetValue("decStr", decStr); </script> %%[ var @encStr set @encStr = "" if not empty(@decStr) then set @encStr = Base64Encode(EncryptSymmetric(@decStr,"aes", @...


5

You can't get into the compilation and delivery phases for LWC and therefore cannot apply your own obfuscation. It seems clear to me that you simply need to ensure that the client code (i.e. the LWC) never receives data that it shouldn't make available to the user by enforcing security concerns in your Apex - without doing this you would never pass a ...


5

I'd recommend not taking this approach for a number of reasons: SSJS doesn't support SHA256 hashing, so you'll need to switch between SSJS and AMPScript that has SHA256 support. This gives rise to a large performance overhead. You'll be looping through a large number of records row-by-row, rather than performing a bulk operation. That's slow. You'll be ...


5

Shield Platform Encryption provides encryption for data at rest. While it does impact your ability to interact with the field data in specific ways primarily around sorting and aggregation (see General Shield Platform Encryption Considerations), data from encrypted fields will be presented to your code in plaintext. Your code will never see the encrypted ...


4

Unfortunately no. Per this doc: Considerations for Using Platform Encryption With Fields https://help.salesforce.com/HTViewHelpDoc?id=security_pe_considerations_all_fields.htm&language=en_US Encrypted fields can’t be used in: Criteria-based sharing rules Filter criteria for list views, reports, and dashboards Portals: communities, ...


4

Check the Blob size that comes back from: Blob PrivateKey = EncodingUtil.base64Decode('Secretkey'); It should be 16 bytes. With the sample code you have the length is only 6, but I suspect that is because you haven't put the actual key in the question. In contrast, the following executes in anonymous apex: Blob PrivateKey = Crypto.generateAesKey(128); ...


4

You don't want to turn your results into a base64 string - it's pretty hard to get a readable string after you do that. Instead, just call the Blob.toString() method: system.debug('This is encrypted data '+ encryptedData.toString()); system.debug('This is decrypted Data '+ decryptedData.toString()); Running this in the console appears to generate the ...


4

Platform Encryption will go further than just preventing the users from seeing data, it will also encrypt the fields at the database level. For example, you can't even issue a SoQL query doing an "Order By XXX" if that field is encrypted. Also, PE lets you encrypt fields not subject to FLS (Account and Contact name, for example). In those cases, users will ...


4

You use SSL to secure data in motion, and the Crypto class to secure data at rest. Generally speaking, you want to secure communication between Salesforce and some other system, you use SSL; you can use Two-Way SSL as a means of authenticating yourself to the remote server (and vise versa) as well as securing the communication. If you want to store data ...


4

Above error is thrown because the private key is not 32 bytes. The expected and actual private key byte calculation is mismatching. Recommended approach to resolve this String algorithmName = 'AES256'; Blob privateKey = Crypto.generateAesKey(256); Blob data = Blob.valueOf('Test data to encrypted'); Blob encryptedData = Crypto....


4

Little late on the answer but I've been working on this recently and someone might find this information useful. If you are looking to do an encryption on data once it is inside Marketing Cloud the 2 main ways to do this would be with SQL activity or script activity. SSJS only support MD5 hashes so this is fairly limiting. AMPscript does have more support ...


Only top voted, non community-wiki answers of a minimum length are eligible