Welcome!

You will be redirected in 30 seconds or close now.

ColdFusion Authors: Yakov Fain, Maureen O'Gara, Nancy Y. Nee, Tad Anderson, Daniel Kaar

Related Topics: ColdFusion

ColdFusion: Article

Public-Key Encryption

Making strong encryption nearly painless

How secure are your applications? Public-Key encryption may be the solution when security really matters.

If you have developed an application that requires user authentication, you have undoubtedly wrestled with varying levels of security. At a basic level, most security models revolve around membership, authentication, and authorization functions. Secure socket layers (SSL) is a popular method for securing the transmission of data between Web server and client. ColdFusion MX and ColdFusion 6.1 have very good integration with Java's Secure Socket Extensions Library, which is capable of 2048-bit encryption. While the transmission of the data over the Internet via SSL helps secure against electronic eavesdropping, the data stored in your applications may still be at risk.

The storage of passwords is a prime example of this security risk. If your database is compromised in some way, the attacker has access to all user accounts and passwords. As a result, programmers have developed various techniques for addressing this issue. ColdFusion itself has an encryption function available - encrypt() - that utilizes an XOR (exclusive OR) algorithm to generate a pseudo 32-bit symmetric key. Another method involves using ColdFusion's hash() function. The hash() function is based on an MD5 (message digest version 5) 128-bit hash algorithm that converts strings into 32-bit hexadecimal "fingerprint" or "message digest" representations of the original string. A stronger variant of this method involves introducing salt - a random string of some length - and concatenating it with the password before performing the hash function.

While storing an encrypted or hashed version of passwords using ColdFusion's built-in functions is a good practice, these methodologies fall a bit short when security is a real issue. The hash() function is a one-way encryption algorithm that can be decrypted only by brute force. MD5 hashing as a method of securing passwords and other data falls apart when one does a Google search of "MD5 crack." For unsalted hashes, the time needed to crack a single MD5 hash online is about 40 minutes (http://passcracking.com). Depending on your personal computer speeds, this can be done faster with a tool like md5crack (www.checksum.org/download/MD5Crack). In fact, in 1994 Paul van Oorschot and Mike Wiener showed that a brute force attack on a 128-bit hash function requires 264 (2.1019) evaluations to crack; at the time such a crack would take less than a month with a $10 million investment in hardware.

To deal with the shortcomings of 128-bit hash functions, stronger encryption algorithms have been invented. Today's 160-bit encryption algorithms such as SHA1 (secure hash algorithm, www.w3.org/PICS/DSig/SHA1_1_0.html) and RipeMD160 (www.esat.kuleuven.ac.be/~bosselae/ripemd160.html) increase the time required for a brute force attack. For areas where a 160-bit hash is still not strong enough, SHA also comes in 256-bit, 384-bit, and 512-bit data lengths for added security in one-way encryption.

Because hash() is a one-way encryption algorithm, it is most appropriate when text does not need to be read (as in the case of passwords). By contrast, the encrypt() function utilizes symmetric-key cryptography, meaning that both the sender and receiver of the string share a common key used to encrypt and decrypt the string. Thus, the private key must at some point be transferred in some secure way, and is only effective if the symmetric key is kept secret.

In ColdFusion, this transfer is done on the server in memory when a page with the encrypt() function is requested, which keeps the transmission of the passphrase reasonably secure. Yet, in the case of encrypt(),the key is actually passed in both the encrypt() and decrypt() functions as plain text:

<cfscript>
   password = "Th1s !s A R@alLy str0nG pA5Sw0rD!";
   symmetricKey = "pa$sPhrAs3 f0r 3ncRypt1ng p4s$w0rDs";

   encrypted = encrypt(password, symmetricKey);
   decrypted = decrypt(encrypted, symmetricKey);
</cfscript>

<cfoutput>
<p>#encrypted# <br/> #decrypted#</p>
</cfoutput>

Depending on who has access to your code, this could be a recipe for disaster.

When you need to be able to encrypt and decrypt, additional steps must be taken. ColdFusion's encrypt() function can be decrypted, but the key must be passed in the code on the server, causing a security issue (plus encrypted data placed on the Web can be fairly easily cracked using any number of free tools available on the Internet.

An alternative to ColdFusion's private-key encryption method is public-key encryption. Public-key encryption - or asymmetric encryption - requires two keys - one private and one public. Data encrypted with your public key can be decrypted only with your private key, allowing you to freely distribute your public key in a non-secure manner (i.e., as clear text posted on a Web page). Asymmetric encryption uses longer algorithms for calculating file fingerprints than symmetric encryption algorithms, and is effective for generating significantly obfuscated data. As a brief side note, these algorithms are processor intensive, so using public key encryption may not be appropriate for very large files.

Unfortunately, in order to take advantage of asymmetric encryption in ColdFusion, you must look beyond built-in ColdFusion tools. The two big players in the realm of public-key cryptography are Pretty Good Privacy (PGP; www.pgp.com) and GNU Privacy Guard (GnuPG; www.gnupg.org). "GnuPG is a complete and free replacement for PGP," and since GnuPG does not depend on the patented International Data Encryption Algorithm (IDEA), there are no restrictions on its use, nor are there any licensing fees for integrating GnuPG into your applications. This last fact makes it an attractive candidate for developers, and is used in the examples for this article. Along with the strong two-way encryption algorithms (1024-bit DSA and ElGamal), GnuPG also supports stronger hashing functions (SHA1, RIPEMD160, and SHA256) for your one-way encryption needs.

More Stories By Wayne Graham

Wayne Graham is a systems administrator at the College of William and Mary's Earl Gregg Swem Library. Wayne is also the co-manager of the Williamsburg Macromedia User's Group and has been developing with ASP, Java, and ColdFusion since 2001.

Comments (10) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
Thomas Gorgolione 07/23/08 05:05:27 PM EDT

You have to compile the code manually from the zip file (see post #5). I did that already, so if you want you can just download it here:

www.tgorg.com/etc/GnuPG.jar

Jeff 01/31/08 08:07:47 AM EST

Does anyone have the GnuPG.jar file? I found the CF component but that still needs the GnuPG.jar file to operate and the link in the article to get GnuPG.jar does not work.

Shaun 09/04/07 02:21:25 PM EDT

Found this:
http://res.sys-con.com/story/46359/source.html

William Broadhead 07/21/05 03:00:51 PM EDT

Good story. Very informative. One thing I would note is that in cf using the encrypt/decrypt: You don't have to, and shouldn't include the actual key in your code, NOR in your Database... A tecnnique I use is to store the key in a text file on the server in a directory that is accessible to coldfusion but NOT part of the http accessible directory. Using cffile you can read and load the information in the file to memory as an application key to use for hashing passwords while never having the key in your code nor in your database. Although obviously, as the article points out, security can never be completely infallible, this can reduce the capacity of your data to be compromised if you did somehow lose a copy of your database or page code, you would need also need to lose the file for someone to put it all together...

Mark 07/14/05 01:53:05 PM EDT

Great article, very well written.

Brad 03/28/05 10:13:32 AM EST

Great Article, convinced my peers to use this instead of upgrading to CF7Mx.

As for the gentleman looking for the source, click the Source Code link located under Related Sites. Scroll down... you're welcome.

Nguyen Tran 03/21/05 10:50:00 AM EST

Where to download the file? GnuPG.jar

The link you provided as:
www.sys-con.com/coldfusion/sourcec.cfm
Point to the page at:
http://sys-con.com/magazine/archives.cfm?id=5

On this page, there is no link to download the file GnuPG.jar

Please give us the link to download the file GnuPG.jar

Thank you

Tom 02/08/05 06:05:04 AM EST

hello,

i´ve the same problem: where is gnupg.jar?
regards, tom

Shane 12/16/04 11:14:17 AM EST

nevermind.... I found it.

Shane 12/16/04 11:09:21 AM EST

Great article. I've been looking forward to trying this out but haven't been able to find the gnupg.jar file. Am I overlooking it somewhere? Please advise.

Thanks.

@ThingsExpo Stories
The Internet of Things is not new. Historically, smart businesses have used its basic concept of leveraging data to drive better decision making and have capitalized on those insights to realize additional revenue opportunities. So, what has changed to make the Internet of Things one of the hottest topics in tech? In his session at @ThingsExpo, Chris Gray, Director, Embedded and Internet of Things, discussed the underlying factors that are driving the economics of intelligent systems. Discover how hardware commoditization, the ubiquitous nature of connectivity, and the emergence of Big Data a...
"BSQUARE is in the business of selling software solutions for smart connected devices. It's obvious that IoT has moved from being a technology to being a fundamental part of business, and in the last 18 months people have said let's figure out how to do it and let's put some focus on it, " explained Dave Wagstaff, VP & Chief Architect, at BSQUARE Corporation, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The major cloud platforms defy a simple, side-by-side analysis. Each of the major IaaS public-cloud platforms offers their own unique strengths and functionality. Options for on-site private cloud are diverse as well, and must be designed and deployed while taking existing legacy architecture and infrastructure into account. Then the reality is that most enterprises are embarking on a hybrid cloud strategy and programs. In this Power Panel at 15th Cloud Expo (http://www.CloudComputingExpo.com), moderated by Ashar Baig, Research Director, Cloud, at Gigaom Research, Nate Gordon, Director of T...
SYS-CON Events announced today that IDenticard will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. IDenticard™ is the security division of Brady Corp (NYSE: BRC), a $1.5 billion manufacturer of identification products. We have small-company values with the strength and stability of a major corporation. IDenticard offers local sales, support and service to our customers across the United States and Canada. Our partner network encompasses some 300 of the world's leading systems integrators and security s...
SYS-CON Events announced today that Windstream, a leading provider of advanced network and cloud communications, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Windstream (Nasdaq: WIN), a FORTUNE 500 and S&P 500 company, is a leading provider of advanced network communications, including cloud computing and managed services, to businesses nationwide. The company also offers broadband, phone and digital TV services to consumers primarily in rural areas.

ARMONK, N.Y., Nov. 20, 2014 /PRNewswire/ --  IBM (NYSE: IBM) today announced that it is bringing a greater level of control, security and flexibility to cloud-based application development and delivery with a single-tenant version of Bluemix, IBM's platform-as-a-service. The new platform enables developers to build ap...

The BPM world is going through some evolution or changes where traditional business process management solutions really have nowhere to go in terms of development of the road map. In this demo at 15th Cloud Expo, Kyle Hansen, Director of Professional Services at AgilePoint, shows AgilePoint’s unique approach to dealing with this market circumstance by developing a rapid application composition or development framework.
“In the past year we've seen a lot of stabilization of WebRTC. You can now use it in production with a far greater degree of certainty. A lot of the real developments in the past year have been in things like the data channel, which will enable a whole new type of application," explained Peter Dunkley, Technical Director at Acision, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
DevOps Summit 2015 New York, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that it is now accepting Keynote Proposals. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.
"People are a lot more knowledgeable about APIs now. There are two types of people who work with APIs - IT people who want to use APIs for something internal and the product managers who want to do something outside APIs for people to connect to them," explained Roberto Medrano, Executive Vice President at SOA Software, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Nigeria has the largest economy in Africa, at more than US$500 billion, and ranks 23rd in the world. A recent re-evaluation of Nigeria's true economic size doubled the previous estimate, and brought it well ahead of South Africa, which is a member (unlike Nigeria) of the G20 club for political as well as economic reasons. Nigeria's economy can be said to be quite diverse from one point of view, but heavily dependent on oil and gas at the same time. Oil and natural gas account for about 15% of Nigera's overall economy, but traditionally represent more than 90% of the country's exports and as...
The Internet of Things is a misnomer. That implies that everything is on the Internet, and that simply should not be - especially for things that are blurring the line between medical devices that stimulate like a pacemaker and quantified self-sensors like a pedometer or pulse tracker. The mesh of things that we manage must be segmented into zones of trust for sensing data, transmitting data, receiving command and control administrative changes, and peer-to-peer mesh messaging. In his session at @ThingsExpo, Ryan Bagnulo, Solution Architect / Software Engineer at SOA Software, focused on desi...
"At our booth we are showing how to provide trust in the Internet of Things. Trust is where everything starts to become secure and trustworthy. Now with the scaling of the Internet of Things it becomes an interesting question – I've heard numbers from 200 billion devices next year up to a trillion in the next 10 to 15 years," explained Johannes Lintzen, Vice President of Sales at Utimaco, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
"For over 25 years we have been working with a lot of enterprise customers and we have seen how companies create applications. And now that we have moved to cloud computing, mobile, social and the Internet of Things, we see that the market needs a new way of creating applications," stated Jesse Shiah, CEO, President and Co-Founder of AgilePoint Inc., in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that Gridstore™, the leader in hyper-converged infrastructure purpose-built to optimize Microsoft workloads, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Gridstore™ is the leader in hyper-converged infrastructure purpose-built for Microsoft workloads and designed to accelerate applications in virtualized environments. Gridstore’s hyper-converged infrastructure is the industry’s first all flash version of HyperConverged Appliances that include both compute and storag...
Today’s enterprise is being driven by disruptive competitive and human capital requirements to provide enterprise application access through not only desktops, but also mobile devices. To retrofit existing programs across all these devices using traditional programming methods is very costly and time consuming – often prohibitively so. In his session at @ThingsExpo, Jesse Shiah, CEO, President, and Co-Founder of AgilePoint Inc., discussed how you can create applications that run on all mobile devices as well as laptops and desktops using a visual drag-and-drop application – and eForms-buildi...
We certainly live in interesting technological times. And no more interesting than the current competing IoT standards for connectivity. Various standards bodies, approaches, and ecosystems are vying for mindshare and positioning for a competitive edge. It is clear that when the dust settles, we will have new protocols, evolved protocols, that will change the way we interact with devices and infrastructure. We will also have evolved web protocols, like HTTP/2, that will be changing the very core of our infrastructures. At the same time, we have old approaches made new again like micro-services...
Code Halos - aka "digital fingerprints" - are the key organizing principle to understand a) how dumb things become smart and b) how to monetize this dynamic. In his session at @ThingsExpo, Robert Brown, AVP, Center for the Future of Work at Cognizant Technology Solutions, outlined research, analysis and recommendations from his recently published book on this phenomena on the way leading edge organizations like GE and Disney are unlocking the Internet of Things opportunity and what steps your organization should be taking to position itself for the next platform of digital competition.
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
As the Internet of Things unfolds, mobile and wearable devices are blurring the line between physical and digital, integrating ever more closely with our interests, our routines, our daily lives. Contextual computing and smart, sensor-equipped spaces bring the potential to walk through a world that recognizes us and responds accordingly. We become continuous transmitters and receivers of data. In his session at @ThingsExpo, Andrew Bolwell, Director of Innovation for HP's Printing and Personal Systems Group, discussed how key attributes of mobile technology – touch input, sensors, social, and ...