I named this file "send.cfm". It encrypts a piece of data and uses cfhttp to submit it onto a receive.cfm page in the root directory of your local Web server. The variable's scope is cfdumped. This will show us our encrypted value and the results of the HTTP post (which will include the decrypted value). Take a look at receive.cfm:

<cfset decryptedstring = decrypt(form.data,'12345')>

<cfoutput>
   #decryptedstring#
</cfoutput>

This page is simpler than the previous. It decrypts the data from the form post, then outputs it. In the real world, you'd use a key that was a little more complicated than "12345" (most likely generating something with the GenerateSecretKey function), and your data will probably not be hard coded, but something taken out of a database. When the time comes, you can expand on the concepts in this example to make something a little more complex. You can read the livedoc information on encrypt at http://livedocs.macromedia.com/coldfusion/7/ htmldocs/00000457.htm#1104201, decrypt at http://livedocs.macromedia.com/coldfusion/7/ htmldocs/00000452.htm#1103962, and GenerateSecretKey at http://livedocs.macromedia.com/coldfusion/7/ htmldocs/00000468.htm#4992278.

Where to Go From Here
What's next? One thing that ColdFusion does not (yet) natively support is a public/private key encryption scheme. In this type of scheme, you would use one key to encrypt data and another to decrypt the data. If you were sending data to me, you would encrypt it with my public key, then it can only be decrypted with my private key and you know that I'll be the only one reading it. Or perhaps I wanted to verify that you were truly the one sending me the data. If you encrypt it using your private key, I can decrypt using your public key. Two keys increase the amount of encryption available.

There are two public / private key tags listed in the Macromedia Developer's exchange, one from www.tamuri.com/ and one from www.digitaloutlook.com/. Both require that you install PGP, which (I'm warning you) will prevent ColdFusion's wsconfig tool from working. It is a roadblock if you are using CFMX in the J2EE configuration. The Tamuri product only works with PGP 8.0, which appears to no longer be available, and I was never able to get it to work. I had much better luck with the Digital Outlook tag, but the tag stopped working for an unknown reason and even support couldn't help me get it back to a functional point. Hopefully Adobe will include this functionality natively in the next release.