Adobe CryptoSupport用于哈希处理什么？

Question

I've read about the Adobe CryptoSupport that is now in CQ5.5+, which is meant to provide a utility for encrypting and decrypting data, for example, to store API keys in the JCR more securely.

The JavaDocs or the general Adobe documentation give no details on its implementation, just stating that:

Note that this method and the decrypt(byte[]) method provide full round trip support:

 decrypt(encrypt(plainText)).equals(plainText) == true 

Please note, that calling this method twice on the same plainText does not return the same cipher text:

 encrypt(plainText).equals(encrypt(plainText)) == false 

This is reasonably useful, but what it doesn't tell me is how these ciphers are enncrypted to begin with. I've tried encrypting on one CQ instance & decrypting on another, but this doesn't seem to work.

To use this feature with confidence, I'd like to know on what CQ bases its encrypted. There are two main concerns I have:

• How do I know that the service is salted (think that's the correct term) based on something secure? Or if it needs to be configured, how do I do that? (ie does it use the equivalent level of security OOTB as a log-in of 'admin/admin'!)
• If the encryption is environment specific, does this mean that I cannot encrypt data & then transfer across between servers?

Answer 1

Bundle description in the Felix console states that

The Crypto Support bundle provides a CryptoSupport services which allows applications to encrypt and decrypt binary and String data. Encryption is based on the symmetric AES/CBC/PKCS5Padding (AES algorithm, CBC mode with PKCS5 padding) from the RSA JSafe libary.

Key is randomly generated during the first start of the Adobe Granite Crypto Support bundle and then saved as /etc/key/master property. It is per-instance by design and I don't think it's a good idea to move this key between CQ installations. Actually, Adobe says it's a good idea to move key between author and publish instances.

Answering your questions:

• you don't need to worry about configuring the service as it's done automatically during the first bundle activation,
• you can move encrypted data from one instance to another as long as you also move the key.