Welcome!

You will be redirected in 30 seconds or close now.

ColdFusion Authors: Yakov Fain, Jeremy Geelan, Maureen O'Gara, Nancy Y. Nee, Tad Anderson

Related Topics: ColdFusion

ColdFusion: Article

Public-Key Encryption

Making strong encryption nearly painless

How secure are your applications? Public-Key encryption may be the solution when security really matters.

If you have developed an application that requires user authentication, you have undoubtedly wrestled with varying levels of security. At a basic level, most security models revolve around membership, authentication, and authorization functions. Secure socket layers (SSL) is a popular method for securing the transmission of data between Web server and client. ColdFusion MX and ColdFusion 6.1 have very good integration with Java's Secure Socket Extensions Library, which is capable of 2048-bit encryption. While the transmission of the data over the Internet via SSL helps secure against electronic eavesdropping, the data stored in your applications may still be at risk.

The storage of passwords is a prime example of this security risk. If your database is compromised in some way, the attacker has access to all user accounts and passwords. As a result, programmers have developed various techniques for addressing this issue. ColdFusion itself has an encryption function available - encrypt() - that utilizes an XOR (exclusive OR) algorithm to generate a pseudo 32-bit symmetric key. Another method involves using ColdFusion's hash() function. The hash() function is based on an MD5 (message digest version 5) 128-bit hash algorithm that converts strings into 32-bit hexadecimal "fingerprint" or "message digest" representations of the original string. A stronger variant of this method involves introducing salt - a random string of some length - and concatenating it with the password before performing the hash function.

While storing an encrypted or hashed version of passwords using ColdFusion's built-in functions is a good practice, these methodologies fall a bit short when security is a real issue. The hash() function is a one-way encryption algorithm that can be decrypted only by brute force. MD5 hashing as a method of securing passwords and other data falls apart when one does a Google search of "MD5 crack." For unsalted hashes, the time needed to crack a single MD5 hash online is about 40 minutes (http://passcracking.com). Depending on your personal computer speeds, this can be done faster with a tool like md5crack (www.checksum.org/download/MD5Crack). In fact, in 1994 Paul van Oorschot and Mike Wiener showed that a brute force attack on a 128-bit hash function requires 264 (2.1019) evaluations to crack; at the time such a crack would take less than a month with a $10 million investment in hardware.

To deal with the shortcomings of 128-bit hash functions, stronger encryption algorithms have been invented. Today's 160-bit encryption algorithms such as SHA1 (secure hash algorithm, www.w3.org/PICS/DSig/SHA1_1_0.html) and RipeMD160 (www.esat.kuleuven.ac.be/~bosselae/ripemd160.html) increase the time required for a brute force attack. For areas where a 160-bit hash is still not strong enough, SHA also comes in 256-bit, 384-bit, and 512-bit data lengths for added security in one-way encryption.

Because hash() is a one-way encryption algorithm, it is most appropriate when text does not need to be read (as in the case of passwords). By contrast, the encrypt() function utilizes symmetric-key cryptography, meaning that both the sender and receiver of the string share a common key used to encrypt and decrypt the string. Thus, the private key must at some point be transferred in some secure way, and is only effective if the symmetric key is kept secret.

In ColdFusion, this transfer is done on the server in memory when a page with the encrypt() function is requested, which keeps the transmission of the passphrase reasonably secure. Yet, in the case of encrypt(),the key is actually passed in both the encrypt() and decrypt() functions as plain text:

<cfscript>
   password = "Th1s !s A [email protected] str0nG pA5Sw0rD!";
   symmetricKey = "pa$sPhrAs3 f0r 3ncRypt1ng p4s$w0rDs";

   encrypted = encrypt(password, symmetricKey);
   decrypted = decrypt(encrypted, symmetricKey);
</cfscript>

<cfoutput>
<p>#encrypted# <br/> #decrypted#</p>
</cfoutput>

Depending on who has access to your code, this could be a recipe for disaster.

When you need to be able to encrypt and decrypt, additional steps must be taken. ColdFusion's encrypt() function can be decrypted, but the key must be passed in the code on the server, causing a security issue (plus encrypted data placed on the Web can be fairly easily cracked using any number of free tools available on the Internet.

An alternative to ColdFusion's private-key encryption method is public-key encryption. Public-key encryption - or asymmetric encryption - requires two keys - one private and one public. Data encrypted with your public key can be decrypted only with your private key, allowing you to freely distribute your public key in a non-secure manner (i.e., as clear text posted on a Web page). Asymmetric encryption uses longer algorithms for calculating file fingerprints than symmetric encryption algorithms, and is effective for generating significantly obfuscated data. As a brief side note, these algorithms are processor intensive, so using public key encryption may not be appropriate for very large files.

Unfortunately, in order to take advantage of asymmetric encryption in ColdFusion, you must look beyond built-in ColdFusion tools. The two big players in the realm of public-key cryptography are Pretty Good Privacy (PGP; www.pgp.com) and GNU Privacy Guard (GnuPG; www.gnupg.org). "GnuPG is a complete and free replacement for PGP," and since GnuPG does not depend on the patented International Data Encryption Algorithm (IDEA), there are no restrictions on its use, nor are there any licensing fees for integrating GnuPG into your applications. This last fact makes it an attractive candidate for developers, and is used in the examples for this article. Along with the strong two-way encryption algorithms (1024-bit DSA and ElGamal), GnuPG also supports stronger hashing functions (SHA1, RIPEMD160, and SHA256) for your one-way encryption needs.

More Stories By Wayne Graham

Wayne Graham is a systems administrator at the College of William and Mary's Earl Gregg Swem Library. Wayne is also the co-manager of the Williamsburg Macromedia User's Group and has been developing with ASP, Java, and ColdFusion since 2001.

Comments (10) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
Thomas Gorgolione 07/23/08 05:05:27 PM EDT

You have to compile the code manually from the zip file (see post #5). I did that already, so if you want you can just download it here:

www.tgorg.com/etc/GnuPG.jar

Jeff 01/31/08 08:07:47 AM EST

Does anyone have the GnuPG.jar file? I found the CF component but that still needs the GnuPG.jar file to operate and the link in the article to get GnuPG.jar does not work.

Shaun 09/04/07 02:21:25 PM EDT

Found this:
http://res.sys-con.com/story/46359/source.html

William Broadhead 07/21/05 03:00:51 PM EDT

Good story. Very informative. One thing I would note is that in cf using the encrypt/decrypt: You don't have to, and shouldn't include the actual key in your code, NOR in your Database... A tecnnique I use is to store the key in a text file on the server in a directory that is accessible to coldfusion but NOT part of the http accessible directory. Using cffile you can read and load the information in the file to memory as an application key to use for hashing passwords while never having the key in your code nor in your database. Although obviously, as the article points out, security can never be completely infallible, this can reduce the capacity of your data to be compromised if you did somehow lose a copy of your database or page code, you would need also need to lose the file for someone to put it all together...

Mark 07/14/05 01:53:05 PM EDT

Great article, very well written.

Brad 03/28/05 10:13:32 AM EST

Great Article, convinced my peers to use this instead of upgrading to CF7Mx.

As for the gentleman looking for the source, click the Source Code link located under Related Sites. Scroll down... you're welcome.

Nguyen Tran 03/21/05 10:50:00 AM EST

Where to download the file? GnuPG.jar

The link you provided as:
www.sys-con.com/coldfusion/sourcec.cfm
Point to the page at:
http://sys-con.com/magazine/archives.cfm?id=5

On this page, there is no link to download the file GnuPG.jar

Please give us the link to download the file GnuPG.jar

Thank you

Tom 02/08/05 06:05:04 AM EST

hello,

i´ve the same problem: where is gnupg.jar?
regards, tom

Shane 12/16/04 11:14:17 AM EST

nevermind.... I found it.

Shane 12/16/04 11:09:21 AM EST

Great article. I've been looking forward to trying this out but haven't been able to find the gnupg.jar file. Am I overlooking it somewhere? Please advise.

Thanks.

@ThingsExpo Stories
SYS-CON Events announced today that Enzu, a leading provider of cloud hosting solutions, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Enzu’s mission is to be the leading provider of enterprise cloud solutions worldwide. Enzu enables online businesses to use its IT infrastructure to their competitive advantage. By offering a suite of proven hosting and management services, Enzu wants companies to foc...
SoftLayer operates a global cloud infrastructure platform built for Internet scale. With a global footprint of data centers and network points of presence, SoftLayer provides infrastructure as a service to leading-edge customers ranging from Web startups to global enterprises. SoftLayer's modular architecture, full-featured API, and sophisticated automation provide unparalleled performance and control. Its flexible unified platform seamlessly spans physical and virtual devices linked via a world...
The IoT is changing the way enterprises conduct business. In his session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, discuss how businesses can gain an edge over competitors by empowering consumers to take control through IoT. We'll cite examples such as a Washington, D.C.-based sports club that leveraged IoT and the cloud to develop a comprehensive booking system. He'll also highlight how IoT can revitalize and restore outdated business models, making them profitable...
As cloud and storage projections continue to rise, the number of organizations moving to the cloud is escalating and it is clear cloud storage is here to stay. However, is it secure? Data is the lifeblood for government entities, countries, cloud service providers and enterprises alike and losing or exposing that data can have disastrous results. There are new concepts for data storage on the horizon that will deliver secure solutions for storing and moving sensitive data around the world. ...
SYS-CON Events announced today that BMC Software has been named "Siver Sponsor" of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2015 at the Javits Center in New York, New York. BMC is a global leader in innovative software solutions that help businesses transform into digital enterprises for the ultimate competitive advantage. BMC Digital Enterprise Management is a set of innovative IT solutions designed to make digital business fast, seamless, and optimized from mainframe to mo...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, will provide an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life ...
Customer experience has become a competitive differentiator for companies, and it’s imperative that brands seamlessly connect the customer journey across all platforms. With the continued explosion of IoT, join us for a look at how to build a winning digital foundation in the connected era – today and in the future. In his session at @ThingsExpo, Chris Nguyen, Group Product Marketing Manager at Adobe, will discuss how to successfully leverage mobile, rapidly deploy content, capture real-time d...
SYS-CON Events announced today that ContentMX, the marketing technology and services company with a singular mission to increase engagement and drive more conversations for enterprise, channel and SMB technology marketers, has been named “Sponsor & Exhibitor Lounge Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York City, New York. “CloudExpo is a great opportunity to start a conversation with new prospects, but what happens after the...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York and Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty ...
IoT generates lots of temporal data. But how do you unlock its value? How do you coordinate the diverse moving parts that must come together when developing your IoT product? What are the key challenges addressed by Data as a Service? How does cloud computing underlie and connect the notions of Digital and DevOps What is the impact of the API economy? What is the business imperative for Cognitive Computing? Get all these questions and hundreds more like them answered at the 18th Cloud Expo...
SYS-CON Events announced today the How to Create Angular 2 Clients for the Cloud Workshop, being held June 7, 2016, in conjunction with 18th Cloud Expo | @ThingsExpo, at the Javits Center in New York, NY. Angular 2 is a complete re-write of the popular framework AngularJS. Programming in Angular 2 is greatly simplified. Now it’s a component-based well-performing framework. The immersive one-day workshop led by Yakov Fain, a Java Champion and a co-founder of the IT consultancy Farata Systems and...
Join us at Cloud Expo | @ThingsExpo 2016 – June 7-9 at the Javits Center in New York City and November 1-3 at the Santa Clara Convention Center in Santa Clara, CA – and deliver your unique message in a way that is striking and unforgettable by taking advantage of SYS-CON's unmatched high-impact, result-driven event / media packages.
SYS-CON Events announced today that EastBanc Technologies will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. EastBanc Technologies has been working at the frontier of technology since 1999. Today, the firm provides full-lifecycle software development delivering flexible technology solutions that seamlessly integrate with existing systems – whether on premise or cloud. EastBanc Technologies partners with p...
18th Cloud Expo, taking place June 7-9, 2016, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterprises are using some...
Companies can harness IoT and predictive analytics to sustain business continuity; predict and manage site performance during emergencies; minimize expensive reactive maintenance; and forecast equipment and maintenance budgets and expenditures. Providing cost-effective, uninterrupted service is challenging, particularly for organizations with geographically dispersed operations.
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management...
The essence of data analysis involves setting up data pipelines that consist of several operations that are chained together – starting from data collection, data quality checks, data integration, data analysis and data visualization (including the setting up of interaction paths in that visualization). In our opinion, the challenges stem from the technology diversity at each stage of the data pipeline as well as the lack of process around the analysis.
What a difference a year makes. Organizations aren’t just talking about IoT possibilities, it is now baked into their core business strategy. With IoT, billions of devices generating data from different companies on different networks around the globe need to interact. From efficiency to better customer insights to completely new business models, IoT will turn traditional business models upside down. In the new customer-centric age, the key to success is delivering critical services and apps wit...
SYS-CON Events announced today that Tintri Inc., a leading producer of VM-aware storage (VAS) for virtualization and cloud environments, will exhibit at the 18th International CloudExpo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, New York, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Designing IoT applications is complex, but deploying them in a scalable fashion is even more complex. A scalable, API first IaaS cloud is a good start, but in order to understand the various components specific to deploying IoT applications, one needs to understand the architecture of these applications and figure out how to scale these components independently. In his session at @ThingsExpo, Nara Rajagopalan is CEO of Accelerite, will discuss the fundamental architecture of IoT applications, ...