If you want to enable AES-192 and AES-256 on ColdFusion Enterprise...

Mon, 16 Nov 2009 12:38:00 -0400

If you want to enable AES-192 or AES-256 on ColdFusion 7/8/9 Enterprise, you will need to download the "Sun Unlimited Strength Jurisdiction Policy Files". The download can be found at the bottom of this page http://java.sun.com/javase/downloads/index.jsp. Once you download the .zip file, you will extract it to: [java-home]\lib\security. Then restart the ColdFusion services. More information about the update can be found at http://java.sun.com/javase/technologies/security/
If you run across this error: "The key specified is not a valid key for this encryption: Illegal key size", most likely it is because you need to install this security update. What I found was that AES with a 128 bit key worked fine, then with a 192 bit and 256 bit key it did not work. The only thing I could find about it was in ColdFusion 7 document located at http://kb2.adobe.com/cps/546/e546373d.html.
You would think Adobe would make sure this note was in the ColdFusion 8 and ColdFusion 9 documentation under the "Encrypt" function. But things get lost, it happens. And you might wonder why this is not in ColdFusion by default, but this is because of US Export rules not allowing certain types of encryption out of the United States.

wolfeman77 - Security

If you want to enable AES-192 and AES-256 on ColdFusion Enterprise...