Decrypt text or file from ColdFusion - PLEASE HELP!!

Report · Nov 12, 2009

First off let me say I know NOTHING about ColdFusion, have no access to it, and it will never be installed in our network.

We have a client that needs to encrypt a file/text to send to us, very sensitive information. The only software he has available to use for encryption is ColdFusion.

He basically had the text flow through ColdFusion, which encrypted it (3DES), and wrote it to a text file. I have the text file and the encryption key. Every program I have tried either does not detect encryption or it outputs gibberish. Next step will be to encrypt the file itself, still waiting for him to send that.

Can anyone help me decrypt text or a file encrypted in ColdFusion? Is there a utility that we can use, preferable with command line support?

Report · Nov 12, 2009

Can anyone help me decrypt text or a file encrypted in
ColdFusion? Is there a utility that we can use, preferable
with command line support?

All modern versions of CF are built on top of java. So assuming the default methods are used, the encryption is performed with standard java encryption.

1. What version of CF and JVM are they using?

2. What settings are used to encrypt (padding, iv, etcetera...)?

3. What program(s) have you used to try and decrypt the data?

4. What are the results from both your program and his? ie Set up some simple/non-confidential test values (string and key) that you can post publicly.

Report · Nov 12, 2009

All the programs I and my co-worker tested would not detect any encryption. One sent out gibberish, but that was a few weeks ago and don't remember which one it was. I test every program I could find that claimed to decrypt text/strings.

Don't know all the answers to your questions and will take me a couple days to get the information from the client.

So, theoretically a Java script could be written to decrypt this file?

Report · Nov 12, 2009

So, theoretically a Java script could be written to decrypt
this file?

No, with java , not javascript. Big difference.

http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/CryptoSpec.html

All the programs I and my co-worker tested would not detect
any encryption. One sent out gibberish, but that was a few
weeks ago and don't remember which one it was. I test
every program I could find that claimed to decrypt
text/strings.

If you are not using the same settings, that is not surprising.

Don't know all the answers to your questions and will take
me a couple days to get the information from the client.

Rather than tackle a whole file at this point, you might want to set up a small test with simple (non-confidential) values you can post to a public forum. It would be easier to assist if we could see some sample code and the results.

Report · Nov 12, 2009

First off let me say I know NOTHING about ColdFusion, have no access to it, and it will never be installed in our network...Can anyone help me decrypt text or a file encrypted in ColdFusion? Is there a utility that we can use, preferable with command line support?

OK. Thinking differently, why don't you consider Coldfusion such a utility? Just as a one-off, since the client's mesage is that important, install Coldfusion Trial Edition (it is free!), decrypt the message, and uninstall Coldfusion.

Report · Nov 12, 2009

I can't do that. This is will be a daily file transfer and decryption that needs to be scripted.