This blog builds on my previous article, which introduced the fundamentals of encryption and decryption in Dynamics 365 Finance & Operations (D365FO). As organizations increasingly rely on integrations, cloud services, and external platforms, protecting sensitive business information has become more important than ever.
Modern ERP systems handle and exchange confidential data daily, including customer records, supplier information, banking details, API credentials, and financial transactions.
While D365FO offers several built-in security features, developers often encounter scenarios where data must be encrypted before it is stored or transmitted.
One of the most common questions is:
Should I use symmetric encryption or asymmetric encryption?
Although both approaches are designed to secure data, they serve different purposes and are suited to different business requirements.
In this article, we’ll explore:
- Symmetric encryption
- Asymmetric encryption
- Practical D365FO use cases
- X++ implementation examples
- Best practices for selecting the right encryption strategy
Symmetric Encryption:
Symmetric encryption uses a single key for both encryption and decryption.
How It Works
- The same key encrypts the data.
- The same key decrypts the data.
Real-Life Analogy
Think of a house key. The same key is used to lock and unlock the door. Anyone with access to that key can both secure and access the contents.
This approach is generally faster and is ideal when the same application needs to encrypt and later decrypt information.
I’ve published a complete X++ implementation of symmetric encryption on my GitHub repository:
This above approach uses AES-256 with PKCS7 padding in Cipher Block Chaining (CBC) mode. A single secret key is used for both encryption and decryption, making it ideal for scenarios where D365FO must securely store and later retrieve sensitive information such as API secrets, OAuth tokens, passwords, and configuration data. The solution leverages the BouncyCastle cryptography library to encrypt plaintext into Base64-encoded ciphertext and decrypt it back to its original value using the same encryption key.
Asymmetric Encryption
Asymmetric encryption uses two separate keys.
Public Key : Used to encrypt data
Private Key : Used to decrypt data
Only the holder of the private key can decrypt information that was encrypted using the corresponding public key.
Real-Life Analogy
Consider a mailbox. Anyone can drop a letter through the slot, but only the mailbox owner, who possesses the key, can access the contents.
This model is particularly useful when exchanging data with external systems or business partners.
I’ve also published a complete X++ implementation of asymmetric encryption on GitHub
This code demonstrates Asymmetric Encryption using RSA-2048 with OAEP-SHA256 padding through the BouncyCastle library in D365FO. A public key is used to encrypt the data, while a corresponding private key is required to decrypt it. The solution includes RSA key pair generation, PEM key handling, Base64 encoding for D365FO storage, and end-to-end encryption and decryption validation using public and private keys.
When executing the test class, the encrypted data was successfully decrypted using the corresponding public and private key pair. The solution also validates that the original and decrypted values match, confirming the correctness of the encryption and decryption process.
How to Choose the Right Approach?
A simple guideline is:
| Requirement | Recommended Approach |
|---|---|
| Store passwords | Symmetric |
| Store API secrets | Symmetric |
| Encrypt data for external party | Asymmetric |
| File transmission to bank | Asymmetric |
| Digital signatures | Asymmetric |
| Internal application data | Symmetric |
Rule of Thumb
If D365FO needs to both encrypt and decrypt the information, symmetric encryption is usually the right choice.
If the encrypted data is intended for another system or organization, asymmetric encryption is typically the better option.
Common Mistakes to Avoid
Using Asymmetric Encryption for Everything
While asymmetric encryption offers additional security benefits, it also introduces complexity and performance overhead. It should be used only when its capabilities are genuinely required.
Hardcoding Encryption Keys
Encryption keys should never be stored directly in source code. Doing so significantly weakens the security of the solution.
Storing Sensitive Data in Plain Text
Always protect confidential information such as:
- Passwords
- Access tokens
- Authentication secrets
- Encryption keys
Leaving sensitive information unencrypted can expose critical business data to unauthorized access.
Conclusion
Encryption plays a vital role in securing modern D365FO implementations, particularly as integrations with cloud services, banking platforms, and third-party applications continue to expand.
Symmetric encryption is the preferred choice when D365FO must both encrypt and decrypt information, making it well-suited for application secrets, configuration settings, and internal business data. Asymmetric encryption, on the other hand, is ideal for secure communication with external systems and certificate-based trust scenarios.
Understanding the strengths and limitations of both approaches enables developers and architects to design solutions that are secure, maintainable, and performant.
The goal is not to use the most complex encryption mechanism everywhere. The goal is to choose the right encryption mechanism for the business problem you are trying to solve.
By making informed encryption decisions, you can build D365FO solutions that not only meet security requirements but also remain scalable and easy to maintain.