0

I am using CryptoJS AES 256 encryption:

CryptoJS.AES.encrypt(string, secret);

The secret is generated through:

function generateKey(str) {
  const salt = CryptoJS.lib.WordArray.random(128 / 8);
  const key512Bits = CryptoJS.PBKDF2(str, salt, {
    keySize: 512 / 32,
    iterations: 100000
  });

  return key512Bits.toString(<-- base64 or hex -->);
}

But it seems like the returned secret string doesn't contain any special character if hex or only '/,+' and wierd ending '==' if base64

Is there any way to make the string much more unpredictable?

Thanks!

1 Answer 1

0

... the returned secret string doesn't contain any special character if hex or only '/,+' and wierd ending '==' if base64. Is there any way to make the string much more unpredictable?

Base64 and Hex are just different kind of string representations of binary data. These representations (encoding) are used to display binary data to some human, or transport binary data through some medium which is not capable of transporting binary data as it is.

The "predictability" in the output you describe is a property of the encoding, not a property of the encoded data, i.e. it happens on fully random input data too. Hex (hexadecimal) encoding just means to encode 4 bits as one character between from 0..9a..f and Base64 just means to encode 6 bits in a similar way. And the == at the end of Base64 just comes from the length of the input not being a multiple of 6 bits, i.e. it is padding.

For more see Hexadecimal and Base64 on Wikipedia.

3
  • Thanks for all the information As now I know someone with an encoding string of iv and key can be converted to the real key and iv hence he/she can decrypt the real data without knowing the the pass-phrase. So what can i do to make the real data more secure along with the pass-phrase?
    – Kim Mỹ
    Jun 16, 2021 at 9:41
  • @KimMỹ: This is a different question than the one you've asked. It should not be asked in the comment. And I'm not sure if you understand the concepts. First: encoding and encryption are completely different things, the first is just a transformation of the data which can be easily reversed, the seconds needs a secret (key, pass-phrase). And the point with encryption is that the attacker will not know the secret and it it is not included in the data. Jun 16, 2021 at 9:59
  • thanks i'll try to make another question
    – Kim Mỹ
    Jun 16, 2021 at 10:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .