encryption with other technologies and coldfusion

For the past week, I have been working on encrypting strings using ColdFusion and needed to make sure that a .Net application could do the same; encrypt the string the same way I was doing it and then return the same encrypted string, so I am able to decrypt it. I was using AES encryption like this:

<cfset key = generateSecretKey("AES") /><!--- i did save the key off but for example purposes just go with this --->

<cfset stringToEnc = "mystring" />

<cfset encryptedString = encrypt(stringToEnc,key,"AES") />

So I told the .Net developer what I was using. He came back and asked things like what cipher mode are you using and what vector are you using and what padding are you going with? Uh? What?! I had no idea. So I did some searching. I found this tech note on Adobe's site here that did describe the other attributes that can be used when using the encrypt and decrypt functions (and these other attributes I actually had to use).

What finally worked was to do this:

<cfset key = generateSecretKey("AES") /><!--- i did save the key off but for example purposes just go with this --->

<cfset stringToEnc = "mystring" />

<cfset salt = "mysaltsixteenchr" /><!--- must be sixteen characters long -->

<cfset encryptedString = encrypt(stringToEnc,key,"AES/CFB/NoPadding","Base64",salt) />

The .Net programmer was successful in using this on his side as well. I could go in to what exactly every attribute means, but I don't have that much time and you can read the article I noted above.

My question is, and I could not find this anywhere, is what are the defaults for the algorithms? For example, what is the default cipher mode and padding for each algorithm? And what is the length the vector or IVorSalt as the documentation states? I'm not a big encryption guy so any help would be appreciated!

kevin penny starts blogging...finally!!!

Kevin Penny, one of my good friends, the guy I learned ColdFusion from, and also a mentor, has finally started blogging!

You can find his blog at http://codefusionllc.blogspot.com/ for ColdFusion tips and more. Heck, I just learned something from his blog about the toScript() function!

why am i up so early this morning?

Well, its not just me who is up. My entire team came into work this morning at 6AM, on a Saturday! That's right, at the crack of dawn. It wasn't even light out yet.

With a few dozen donuts, bananas, and gallons of coffee, we started our ColdFusion 8 upgrade on all of our environments, that's over 20 servers.

So far it is going well. No real hiccups or problems. Our system administrator is the man. He had alot of things scripted out and a complete ColdFusion 8 Install Manual for our environments.

I will update when we get our servers (clusters) up and running.

UPDATE: 8:59 AM Two of our three clusters are now online!

UPDATE: 10:35 AM All done! We are now in the ColdFusion 8 world!

redraw cfgrid with the render method not refresh

Today I was working on using <cfgrid> with a format of html. I really like how it looks and the sorting on the columns of data rocks!

In the application I am working on (still top secret until the end of the month), we have a tabbed display, with each tab being a div and the first div being shown on the screen. My grid was in the second tab/div. The grid was populated with data I knew that from looking in Firebug at the response from my ColdFusion.navigate() method called to create the tabs. The JavaScript has all the data in it if you look. But, my grid was not being displayed, just a bit of a frame around where it was supposed to be.

So I did some digging and found the ColdFusion.Grid.refresh() method. I tried that. No dice. So I did some more digging and looked into the actual cfgrid.js file that <cfgrid> uses. It is under your CFIDE/scripts/ajax/package/ directory. I found that ColdFusion.Grid extends Ext.grid class the of the Ext toolkit. Which <cfgrid> and other controls extend.

In looking up the Ext toolkit documentation I found a method called render(). I was initially looking for a redraw() method, and this one caught my eye. And because the ColdFusion.Grid class extends the Ext.grid class, this method is available to use. I called it just about like this:

<a href="#" onclick="ColdFusion.Grid.getGridObject('MyGrid').render();">Refresh Grid</a>

This method redraws the grid and only the grid, not the entire page or div or frame that it is in. The best part of this is that the <cfgrid> and other controls extend an awesome JavaScript library so not only can we use the methods that Adobe has put on these objects, but the underlying methods as well!

coldfusion built-in ajax calls

For the past two days, I have been getting this error coming back from a ColdFusion.navigate() call. It comes back in an annoying JavaScript alert box like this:

Error processing JavaScript markup for element myDiv: [Enable debugging by adding 'cfdebug' to your URL parameters to see more information]

Okay. So I go to the CF Admin and turn on "Enable AJAX Debug Log Window". I think add "cfdebug=1" on my url. I still get the JavaScript alert box telling me I still have an error, and I don't see the nice debugger in my browser either. I really have no idea why this isn't working, and if someone can shed some light on this, please let me know. But for now, that is not the subject of my post today.

Anyway, I found out why I kept getting that error! In one of my rendered files (display.cfm) I had some JavaScript code in a set of <script> tags, like this:

<script>
var myFunc = function() {
//JS code here }
</script>

I started removing pieces of the display to see where the error was. This was after I stopped banging my head on the desk. What I found was that if that JavaScript code was not in there, the error went away. So I tried to do a JavaScript include like this:

<script src="/path/to/js/file/display.js" type="text/javascript"></script>

Well, no more error, but the JavaScript did not execute when the rendered page loaded. So I went to the ColdFusion.navigate documentation and saw that it has a parameter named "callbackhandler". This parameter names a JavaScript method you can call after the page loads. So I created a new displayCallbackHandler() method and it looked something like this:

var displayCallbackHandler = function() {
//JS code here {

It worked! No more JavaScript alert box from ColdFusion, the JavaScript I had in the displayCallbackHandler method executed!

upgrade to model-glue unity complete

Last week, my team had Joe Rinehart come to help us upgrade to Model-Glue Unity and to have him experience, if only for five days, a real Minnesota winter!

The application that I work on just plain worked on Model-Glue 2.0! Once we changed the mapping to the new Model-Glue Unity directory, but, because we did not want it to be a legacy application, we moved it to use the Unity core.

Some things I REALLY like about Model-Glue 2.0 (Unity).

1. The new <include /> tag in the ModelGlue.xml file rocks! Before, we had to use the <!ENTITY> tag for including other XML files into the base file. We also had to use ANT to change the pathing when it was pushed to production. No more thanks to the <include /> tag!

2. Having Model-Glue use an already existing ColdSpring bean factory! In the index.cfm page use the built-in configuration setting for Model-Glue like this: <cfset ModelGlue_PARENT_BEAN_FACTORY = application.myBeanFactory />. I load up ColdSpring in my Application.cfc and just have Model-Glue load itself into that same bean factory, and now it also has access to all of the beans in that bean factory!

3. And finally, I like that Model-Glue uses ColdSpring to configure itself and load itself into memory. To me it just makes more sense and rather than have a separate set of config settings, why not use ColdSpring to do it for you!

So now, my application has been migrated to Model-Glue Unity and the regression testing is going very well, actually I have not found one issue with the upgrade. As we are probably one of the last teams to upgrade to Model-Glue Unity, none of this will shock anyone, but if there are others out there who have not upgraded, it is worth the little time it takes to do the upgrade.

More Entries

BlogCFC was created by Raymond Camden. This blog is running version 5.7.002.