ColdFusion's CFMX_COMPAT encryption algorithm

coldfusion, encryption

Solution

It is an XOR-based algorithm, but not a text-book one, so blanket XOR-algorithm answers are not correct (and have been applied to these CFMX_COMPAT questions incorrectly in the past).

For a detailed look at the source code to this proprietary XOR, check this answer to "Compare Password Hashes Between C# and ColdFusion", in which @Leigh (who also commented on one of these questions) helped provide an accurate port of the algorithm, lifted directly from the Railo source.

Problem

In reviewing some old coldfusion code, I've found several instances of data being encrypted with the CFMX_COMPAT algorithm via the encrypt/decrypt functions. After searching around for a while, I've been unable to find what kind of algorithm this is. The docs mention that it is now the least secure method, but I'd like to know why that is. (A couple of people elesewhere have suggested that it's just MD5, but that doesn't make a lot of sense as the data is being decrypted.)

Original source

Related problems