Hi @zhaque
The issue here is that trying to do AES on the client exposes the secret key in the JavaScript for any reasonably proficient developer (or hacker) to see.
As @steve_lake suggestions, the Crypto extension may be a better choice here. Although that is also done client-side, the difference is that it is one-way encryption. Depending on what you are trying to do, the idea might work like this;
You have a set of email addresses that you Hash offline and put in a database server side (both the email address and the hash)
You then hash the datalayer email address client-side and in your server side code, you look up the match for that hash. That way, the tag never sees the actual email address.
This is how several service providers such as Facebook work - you pass a list of email addresses to them in private, and in public, you only ever pass the hash of the email address to them.
If you wish to use that approach, the choice of hashing algorithm is important - SHA256 is a standard one. You should also read up about "Salting" for possible extra security.
If, on the other hand, you cannot operate like this, because for example you do not have a master list of email addresses, then you do indeed need two-way encryption. This cannot be accomplished purely client-side, because the secret key is exposed. So, you'd either have to arrange for the email address to be present in the datalayer already encrypted, or you'd have to use a server-side service to accept the unencrypted email and return the encrypted value, while keeping the key secret.
... View more