Product
Introducing SSO
Streamline your login process and enhance security by enabling Single Sign-On (SSO) on the Socket platform, now available for all customers on the Enterprise plan, supporting 20+ identity providers.
@anvilco/encryption
Advanced tools
Readme
This library is a small wrapper around node's crypto
library. It offers convenience methods for encrypting and decrypting arbitrary payloads in both AES and RSA.
For use encrypting / decrypting payloads in Anvil, you can generate an RSA keypair from your organization's settings page.
Anvil provides easy APIs for all things paperwork.
Learn more about Anvil on our Anvil developer page.
yarn add @anvilco/encryption
Then use it
// For RSA functions
import { encryptRSA, decryptRSA } from '@anvilco/encryption'
// For AES functions
import { generateAESKey, encryptAES, decryptAES } from '@anvilco/encryption'
// Could grab the keys from file (or preferably from environment variables)
import fs from 'fs'
const privateKey = fs.readFileSync('path/to/privateKey.pem')
const publicKey = fs.readFileSync('path/to/publicKey.pem')
// RSA
const message = 'Super secret message'
const encryptedRSAMessage = encryptRSA(publicKey, message)
const origRSAMessage = decryptRSA(privateKey, encryptedRSAMessage)
console.log(origRSAMessage === message) // => true
// AES
const aesKey = generateAESKey()
const encryptedAESMessage = encryptAES(aesKey, message)
const origAESMessage = decryptAES(aesKey, encryptedAESMessage)
console.log(origAESMessage === message) // => true
There are two functions for RSA: encryptRSA
, decryptRSA
, and three for AES: generateAESKey
, encryptAES
, decryptAES
.
There are three functions for AES:
key = generateAESKey()
encryptedMessage = encryptAES(key, plainMessage)
plainMessage = decryptAES(key, encryptedMessage)
encryptAES
creates a unique IV for each message encrypted and prepends it to the resulting encrypted payload. So encryptedMessage
will be in the format
<iv>:<aesEncryptedPayload>
There are two functions for RSA:
encryptedMessage = encryptRSA(publicKey, plainMessage)
plainMessage = decryptRSA(privateKey, encryptedMessage)
These functions encrypt / decrypt with RSA and AES. RSA has an upper limit on how much data it can encrypt. So we create an AES key, encrypt the AES key with RSA, then encrypt the actual message with AES.
Note the encrypted payload (result of encryptRSA
) is in the format:
<rsaEncryptedAESKey>:<aesEncryptedMessage>
This library does not have a way to generate RSA keys.
You could use openssl:
# This generates a 2048 bit private key to file
openssl genrsa -out privateKey.pem 2048
# This extracts the public key to file
openssl rsa -in privateKey.pem -outform PEM -pubout -out publicKey.pem
You could also use something like node-rsa:
// Example generating a RSA keypair with node-rsa
import NodeRSA from 'node-rsa'
function generateRSAKeypair () {
const key = new NodeRSA()
key.generateKeyPair(2048, 65537)
return {
publicKey: key.exportKey('pkcs8-public-pem'),
privateKey: key.exportKey('pkcs8-private-pem'),
}
}
MIT
FAQs
RSA and AES Encryption helpers
The npm package @anvilco/encryption receives a total of 1,027 weekly downloads. As such, @anvilco/encryption popularity was classified as popular.
We found that @anvilco/encryption demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Streamline your login process and enhance security by enabling Single Sign-On (SSO) on the Socket platform, now available for all customers on the Enterprise plan, supporting 20+ identity providers.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.