Problems when using AES encryption between Node and CryptoJS in the browser


green 13

I want to encrypt a string using Node and decrypt it using CryptoJS in the browser.

encryption:

var crypto = require('crypto');

function encrypt(txt, cryptkey) {
    var cipher = crypto.createCipher('aes-256-cbc', cryptkey);
    var crypted = cipher.update(txt, 'utf8', 'hex');
    crypted += cipher.final('hex');
    return crypted;
}

encrypt('1', 'key'); // 83684beb6c8cf063caf45cb7fad04a50

include:

<script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/aes.js"></script>

Decrypt:

var decrypted = CryptoJS.AES.decrypt('83684beb6c8cf063caf45cb7fad04a50', 'key');
console.log(decrypted.toString(CryptoJS.enc.Utf8)); // empty string

The actual result is an empty string.

What is the correct way to decrypt data from a node?

Artjom B.

CryptoJS supports the same password-based encryption mode supported by the crypto module in node.js, which is implemented as equivalent to EVP_BytesToKey. By default, CryptoJS generates random salts, but node.js does not and uses empty salts. Empty salts are bad and should not be used. Also, using this method to derive keys from passwords is not secure. One needs to use PBKDF2 (supported by CryptoJS and node.js) or similar, with a lot of iteration and random addition of salt.

var ctHex = '83684beb6c8cf063caf45cb7fad04a50';
var ct = CryptoJS.enc.Hex.parse(ctHex);
var salt = CryptoJS.lib.WordArray.create(0); // empty array
var decrypted = CryptoJS.AES.decrypt({ciphertext: ct, salt: salt}, 'key');

document.querySelector("#dec").innerHTML = decrypted.toString(CryptoJS.enc.Utf8);
<script src="https://cdn.rawgit.com/CryptoStore/crypto-js/3.1.2/build/rollups/aes.js"></script>
Expected: "1"<br/>Got: "<span id="dec"></span>"


You said this will be done over HTTP.

If you want to use transport security, without user intervention, then this is completely insecure, as this makes this best ciphertext obfuscated with the sending key requirement .

If both the user and the server know the password before communicating , this is still not enough, because the key derivation provided by both CryptoJS and node.js is not enough and a PBKDF2 -like password must be used . MD5 is easy to brute force.

You will need to use asymmetric encryption to protect this communication from a passive attacker (who cannot inject arbitrary packets into the flow between server and client). I suggest you generate an RSA key pair and send the public key to the client so the client can encrypt messages sent to the server. You can use forge for this .


Encryption looks like this:

var salt = CryptoJS.lib.WordArray.create(0); // empty array
var params = CryptoJS.kdf.OpenSSL.execute('key', 256/32, 128/32, salt);
var pt = '1';
var encrypted = CryptoJS.AES.encrypt(pt, params.key, {iv: params.iv});

document.querySelector("#enc").innerHTML = encrypted.ciphertext.toString();
<script src="https://cdn.rawgit.com/CryptoStore/crypto-js/3.1.2/build/rollups/aes.js"></script>
Expected: "83684beb6c8cf063caf45cb7fad04a50"<br/>Got: "<span id="enc"></span>"

Related


AES encryption using CryptoJS

Sergio David Romero I need to implement AES encryption using JavaScript. Use AES/CBC/NoPadding mode, and created a way to do it in 16-length blocks. I have solved it using Java. look like: public static String encrypt(byte[] key, byte[] initVector, String valu

AES encryption using CryptoJS

Sergio David Romero I need to implement AES encryption using JavaScript. Use AES/CBC/NoPadding mode, and created a way to do it in 16-length blocks. I have solved it using Java. looks like: public static String encrypt(byte[] key, byte[] initVector, String val

Sync AES encryption between cryptoJS and openSSL (ruby)

WKx I can't get the same results when using CryptoJS or Ruby's OpenSSL encryption JS code k=CryptoJS.enc.Hex.parse('ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb'); iv=CryptoJS.enc.Hex.parse('3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4ac

Sync AES encryption between cryptoJS and openSSL (ruby)

WKx I can't get the same results when using CryptoJS or Ruby's OpenSSL encryption JS code k=CryptoJS.enc.Hex.parse('ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb'); iv=CryptoJS.enc.Hex.parse('3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4ac

AES encryption/decryption in javascript using CryptoJS

Anthracene I am trying to send AES encrypted messages between javascript and php using a shared key. In Javascript, I am using the CryptoJS library. In php, I am using mycrypt. I am trying to construct an encrypted message in javascript and then decrypt it in

AES encryption/decryption in javascript using CryptoJS

Anthracene I am trying to send AES encrypted messages between javascript and php using a shared secret. In Javascript, I am using the CryptoJS library. In php, I am using mycrypt. I am trying to construct an encrypted message in javascript and then decrypt it

AES encryption/decryption in javascript using CryptoJS

Anthracene I am trying to send AES encrypted messages between javascript and php using a shared secret. In Javascript, I am using the CryptoJS library. In php, I am using mycrypt. I am trying to construct an encrypted message in javascript and then decrypt it

AES encryption/decryption in javascript using CryptoJS

Anthracene I am trying to send AES encrypted messages between javascript and php using a shared secret. In Javascript, I am using the CryptoJS library. In php, I am using mycrypt. I am trying to construct an encrypted message in javascript and then decrypt it

AES encryption with CryptoJS and PHP

Shasha I want to implement AES encryption using JavaScript. AES CBC mode to use. I have managed to do this in PHP. look like: public function encrypt($value) { if (empty($value)) { return $value; } $value = Unicode::convertTo

AES encryption with CryptoSwift and CryptoJS

Christopher Robert I want to try to encrypt text using CryptoSwift for an ios app and CryptoJS for a web app, which must be decrypted in the Java platform. I can successfully encrypt in javascript using the following code. var message = "Hello" var password =

AES encryption with CryptoJS and PHP

Shasha I want to implement AES encryption using JavaScript. AES CBC mode to use. I have managed to do this in PHP. looks like: public function encrypt($value) { if (empty($value)) { return $value; } $value = Unicode::convertT

Alternative to repeat cryptojs aes encryption in node.js

Yuvraj Garg I have an encrypted email id which I store in a database. Next time the same email id comes up, I want to encrypt it and query the database if the same email id exists. As far as I know, the randomness of AES is one of the key aspects of its securi

Using Pkcs5 padding with AES encryption in Cryptojs

Mohamed A. Shebl I just need to use cryptojs AES encryption, but to not find padding Pkcs5 in Cryptjs documentation, I want to do it because the backend needs it. It works fine with Pkcs7 and cipher mode ECB, how can I convert this function to work with Pkcs5

AES encryption with CryptoJS and decryption with CodeIgniter

fire brand I'm trying to encrypt a username (written in Codeigniter 3) sent to my server via a POST request, so I'm using CryptoJS to do it client-side like this: var user = $('.user').val(); var key = "<? echo($key);?>"; //$key is created on the server side v

AES encryption with CryptoJS and decryption with CodeIgniter

fire brand I'm trying to encrypt a username (written in Codeigniter 3) sent to my server via a POST request, so I'm using CryptoJS to do it client-side like this: var user = $('.user').val(); var key = "<? echo($key);?>"; //$key is created on the server side v

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES CBC: JavaScript/CryptoJS encryption -> Golang decryption

DjH Note: This is for personal use and learning only, I don't plan to use my encryption for public use. I need to AES256 encrypt the string, but my current attempt ends up with something like the server side string Salted__Vέ��|��l��ʼ8XCQlYwhen hex decoded . W

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES CBC: JavaScript/CryptoJS encryption -> Golang decryption

DjH Note: This is for personal use and learning only, I don't plan to use my encryption for public use. I need to AES256 encrypt the string, but my current attempt ends up with something like the server side string Salted__Vέ��|��l��ʼ8XCQlYwhen hex decoded . W

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES-CTR encryption in Go and decryption in CryptoJS

Mark: I'm having trouble decrypting text encrypted in Go lang using CryptoJS. Here is the Go code : https://play.golang.org/p/xCbl48T_iN package main import ( "crypto/aes" "crypto/cipher" "encoding/base64" "fmt" ) func main() { key := []b

AES encryption in C# and decryption in CryptoJS

Pabitra Dash I want to perform AES encryption in C# and decryption in CryptoJS. Pabitra Dash After getting some references from the Google CryptoJS group ( https://groups.google.com/forum/#!msg/crypto-js/ysgzr2Wxt_k/_Wh8l_1rhQAJ ) it now works fine . Here is t