Need to store encrypted user code in our database and get the decrypted form in return. Using the standard node module crypto to do so. Wanted to understand the strength of below encryption in terms of security. Does it offer enough security and how does choice of password affect strength of encryption here. Sorry a bit new to security and encryption.

var crypto = require('crypto');
var algorithm = 'aes256'; // or any other algorithm supported by OpenSSL
var key = 'some_password';
var text = 'EGGDFRR';

var cipher = crypto.createCipher(algorithm, key);  
var encrypted = cipher.update(text, 'utf8', 'hex') + cipher.final('hex');
var decipher = crypto.createDecipher(algorithm, key);
var decrypted = decipher.update(encrypted, 'hex', 'utf8') + decipher.final('utf8');
  • A passsword is no key. Aug 7, 2017 at 8:39
  • password can be any password. As I mentioned above I wanted to understand how choice of password affects strength of encryption here. Aug 7, 2017 at 9:19

1 Answer 1

var key = 'some_password';

This needs to go.

Using a printable string as the actual key is not a good idea. You're likely only going to be selecting printable characters from the bottom half of the ASCII table which is a very small amount of entropy per byte, and sure this may be for testing but you would do well to look into the complete solution even at this stage.

Even if you're only exploring or practising, old habits die hard. Start secure.

The crypto module provides for a Password-based Key Derivation Function (PBKDF2), that can turn printable strings into pretty good key material as the crypto.pbkdf2 class.

  • some_password was only a sample password. Obviously in production there would be a strong password. Aug 7, 2017 at 11:30
  • 1
    Even a "strong" alpha-numeric password with symbols is rather weak compared to a byte array taken from a good random source, and you should at least be salting it before using it as an actual encryption key. You also need to make sure the phrase is the same length as the cipher's key. crypto.pbkdf does all this for you as well as adding rounds to deter brute-force attacks. These exist for a reason, and are not hard to implement, but improve security over text-based strings by many orders of magnitude. Again, get in the habit of using proper security even when experimenting or prototyping. Aug 7, 2017 at 12:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .