Understanding AES Encryption in SFMC

AES encryption is a widely used symmetric encryption algorithm, and in Salesforce Marketing Cloud, it can be utilized through the use of AMPScript functions such as EncryptSymmetric.

As per the documentation, the default mode for DES encryption is indeed CBC. However, the default mode for AES encryption was not explicitly stated, leading to some confusion among developers.

Fortunately, with the help of the Salesforce community and support, it has been confirmed that the default mode for AES encryption is indeed CBC, similar to DES encryption.

Technical Details

For those interested in the technical details, the AES encryption in SFMC uses a block size of 16, a key size of 32, PBKDF2 with 1000 iterations, and PKCS7 padding.

example.amp

%%[
  var @encrypted
  set @encrypted = EncryptSymmetric(@plaintext, @key, "AES")
]%%

The root cause of the confusion was the lack of explicit documentation on the default mode for AES encryption in SFMC.

Best Practices

To ensure secure encryption, it is essential to follow best practices, such as using a secure key and proper padding.

Checklist for Secure AES Encryption

• Use a secure key
• Use proper padding (PKCS7)
• Use a sufficient block size (16)
• Use a sufficient key size (32)
• Use PBKDF2 with a sufficient number of iterations (1000)

What is the default mode for AES encryption in SFMC?

The default mode for AES encryption is CBC.

What is the block size used for AES encryption in SFMC?

The block size used is 16.

What is the key size used for AES encryption in SFMC?

The key size used is 32.

What type of padding is used for AES encryption in SFMC?

PKCS7 padding is used.