What’s wrong with nodejs crypto decipher?

by

The encrypted data starts with a 8 byte “magic” indicating that there is a salt (the ASCII encoding of "Salted__"). Then the next 8 bytes is the salt. Now the bad news: Node.js does not seem to use the salt for the EVP_BytesToKey method:

int key_len = EVP_BytesToKey(cipher, EVP_md5(), NULL,
  (unsigned char*) key_buf, key_buf_len, 1, key, iv);

That NULL is the salt.

This has been verified using a Java test application (using the right salt) – the result string was returned.

Please leave out the salt using the OpenSSL -nosalt switch and try again.

[EXAMPLE]

OpenSSL CLI:

openssl enc -aes-256-cbc -nosalt -a -k password
owlstead
Mh5yxIyZH+fSMTkSgkLa5w==

NodeJS crypto:

var crypto=require('crypto')
var cipher=crypto.createDecipher('aes-256-cbc', "password")
var enc = cipher.update("Mh5yxIyZH+fSMTkSgkLa5w==", 'base64', 'utf8')
enc += cipher.final('utf8')

[LATE EDIT] Note that using secret key derivation with a salt and large work factor may be paramount to security. You’d better use a very unique, high entropy password otherwise your encrypted data may be at risk.

[REALLY LATE EDIT] OpenSSL 1.1.0c changed the digest algorithm used in some internal components. Formerly, MD5 was used, and 1.1.0 switched to SHA256. Be careful the change is not affecting you in both EVP_BytesToKey and commands like openssl enc.

More Related Contents:

  1. Decrypting AES256 with node.js returns wrong final block length
  2. create a trusted self-signed SSL cert for localhost (for use with Express/Node)
  3. Java openssl encryption / decryption key generation [duplicate]
  4. How random is crypto#randomBytes?
  5. Find the version of an installed npm package
  6. What does body-parser do with express?
  7. NodeJS – What does “socket hang up” actually mean?
  8. Why does mongoose always add an s to the end of my collection name
  9. How can I see the SQL generated by Sequelize.js?
  10. Cannot install node modules that require compilation on Windows 7 x64/VS2012
  11. How do I prevent node.js from crashing? try-catch doesn’t work
  12. Test process.env with Jest
  13. How to send email from my react web application
  14. Mongoose update without callback
  15. What does middleware and app.use actually mean in Expressjs?
  16. Send mail via Google Apps Gmail using service account domain wide delegation in nodejs
  17. How to define object in array in Mongoose schema correctly with 2d geo index
  18. Scaling Node.js
  19. Cannot uninstall angular-cli
  20. Model.find() returns empty in mongoose [duplicate]
  21. Reading all files in a directory, store them in objects, and send the object
  22. nodejs “npm ERR! code SELF_SIGNED_CERT_IN_CHAIN”
  23. What’s the maximum size of a Node.js Buffer
  24. Mongodb find created results by date today
  25. How to use socket.io in express routes?
  26. how to create a readable stream from a remote url in nodejs?
  27. Express Router undefined params with router.use when split across files
  28. Connect or Express middleware to modify the response.body [closed]
  29. Using multiple parameters in URL in express
  30. Create unique autoincrement field with mongoose [duplicate]

Leave a Comment