Question

I recently did a website for my company using ColdFusion 9. The issue I am having is with the ColdFusion encryption/decryption function. On certain strings that I decrypt I get these weird special characters that show up.

Example:

MK/_0 <—Encrypted String Outputted

�#5&z <—Decrypted String Outputted

I’m not sure why this is happening (and only on certain strings that get decrypted).

Here is the code:

<cfset ccNum = decrypt(getCCInfo.CUST_CARDNUMBER,myKey)>

Answer 1

Ok, well first, I have to point out that by not specifying an encryption algorithm you are using very POOR encryption. So you’ll need to fix that. Second, you should probably be using some encoding to make your crypto storage more reliable.

So try this code.

<cfset key = generateSecretKey("AES") />

<!--- Set the ciphertext to a variable. This is the string you will store for later deciphering --->
<cfset cipherText = encrypt(plaintext, key, "AES/CBC/PKCS5Padding", "HEX") />

<cfoutput>#cipherText#</cfoutput> 

<!--- Then when you decrypt --->

<cfset decipherText = decrypt(cipherText, key, "AES/CBC/PKCS5Padding", "HEX") />

<cfoutput>#decipherText#</cfoutput>

The above code will use a strong crypto algorithm and will put the ciphertext into a much easier to store format than the gibberish you showed as an example above. That way when you store it, it will be more reliable when you retrieve it again.

Here is an example of what the string will look like:

A51BBB284D6DCCDC17D26FB481584236087C3AB272918E17963BAF749438C06A484922820EDCCD25150732CC5CF8A096