Security News
JavaScript Leaders Demand Oracle Release the JavaScript Trademark
In an open letter, JavaScript community leaders urge Oracle to give up the JavaScript trademark, arguing that it has been effectively abandoned through nonuse.
@aws-crypto/client-node
Advanced tools
@aws-crypto/client-node is an AWS SDK for JavaScript library that provides client-side encryption and decryption for data. It allows developers to securely encrypt and decrypt data using AWS Key Management Service (KMS) and other cryptographic materials.
Encrypt Data
This feature allows you to encrypt data using a KMS keyring. The code sample demonstrates how to encrypt a simple string using a specified KMS key.
const { encrypt } = require('@aws-crypto/client-node');
const { KmsKeyringNode } = require('@aws-crypto/kms-keyring-node');
const keyring = new KmsKeyringNode({
generatorKeyId: 'arn:aws:kms:us-west-2:123456789012:key/abcd1234-a123-456a-a12b-a123b4cd56ef',
});
const context = {
stage: 'demo',
purpose: 'simple demonstration',
origin: 'us-west-2',
};
const plaintext = 'Hello, World!';
(async () => {
const { result } = await encrypt(keyring, plaintext, { encryptionContext: context });
console.log(result); // Encrypted data
})();
Decrypt Data
This feature allows you to decrypt data that was previously encrypted using a KMS keyring. The code sample demonstrates how to decrypt the encrypted string from the previous example.
const { decrypt } = require('@aws-crypto/client-node');
const { KmsKeyringNode } = require('@aws-crypto/kms-keyring-node');
const keyring = new KmsKeyringNode({
generatorKeyId: 'arn:aws:kms:us-west-2:123456789012:key/abcd1234-a123-456a-a12b-a123b4cd56ef',
});
const encryptedData = '...'; // Encrypted data from the previous example
(async () => {
const { plaintext, messageHeader } = await decrypt(keyring, encryptedData);
console.log(plaintext.toString()); // Decrypted data
})();
Generate Data Key
This feature allows you to generate a data key that can be used for client-side encryption. The code sample demonstrates how to generate a 32-byte data key using a specified KMS key.
const { generateDataKey } = require('@aws-crypto/client-node');
const { KmsKeyringNode } = require('@aws-crypto/kms-keyring-node');
const keyring = new KmsKeyringNode({
generatorKeyId: 'arn:aws:kms:us-west-2:123456789012:key/abcd1234-a123-456a-a12b-a123b4cd56ef',
});
(async () => {
const { plaintextKey, ciphertextKey } = await generateDataKey(keyring, { numberOfBytes: 32 });
console.log(plaintextKey); // Plaintext data key
console.log(ciphertextKey); // Encrypted data key
})();
The aws-sdk package is the official AWS SDK for JavaScript, which provides a wide range of services including KMS for encryption and decryption. While it offers broader functionality, it does not provide the same level of client-side encryption and decryption capabilities as @aws-crypto/client-node.
node-forge is a JavaScript library that provides a set of cryptographic tools, including encryption, decryption, and key generation. It is more general-purpose compared to @aws-crypto/client-node and does not integrate directly with AWS KMS.
crypto-js is a popular library for cryptographic operations in JavaScript. It provides a variety of algorithms for encryption and hashing but does not offer direct integration with AWS services like @aws-crypto/client-node.
The client-node module includes all of the modules you need to use the AWS Encryption SDK for JavaScript with Node.js.
For code examples that show you how to these modules to create keyrings and encrypt and decrypt data, install the example-node module.
To install this module, use the npm package manager. For help with installation, see https://www.npmjs.com/get-npm.
npm install @aws-crypto/client-node
const { KmsKeyringNode, encrypt, decrypt } = require('@aws-crypto/client-node')
/* Start by constructing a keyring. We'll create a KMS keyring.
* Specify an AWS Key Management Service (AWS KMS) customer master key (CMK) to be the
* generator key in the keyring. This CMK generates a data key and encrypts it.
* To use the keyring to encrypt data, you need kms:GenerateDataKey permission
* on this CMK. To decrypt, you need kms:Decrypt permission.
*/
const generatorKeyId = 'arn:aws:kms:us-west-2:658956600833:alias/EncryptDecrypt'
/* You can specify additional CMKs for the keyring. The data key that the generator key
* creates is also encrypted by the additional CMKs you specify. To encrypt data,
* you need kms:Encrypt permission on this CMK. To decrypt, you need kms:Decrypt permission.
*/
const keyIds = ['arn:aws:kms:us-west-2:658956600833:key/b3537ef1-d8dc-4780-9f5a-55776cbb2f7f']
/* Create the KMS keyring */
const keyring = new KmsKeyringNode({ generatorKeyId, keyIds })
/* Set an encryption context For more information:
* https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#encryption-context
*/
const context = {
stage: 'demo',
purpose: 'simple demonstration app',
origin: 'us-west-2'
}
/* Create a string to encrypt */
const cleartext = 'asdf'
/* Encrypt the string using the keyring and the encryption context
* the Encryption SDK returns an "encrypted message" (`result`) that includes the ciphertext
* the encryption context, and the encrypted data keys.
*/
const { result } = await encrypt(keyring, cleartext, { context })
/* Decrypt the result using the same keyring */
const { plaintext, messageHeader } = await decrypt(keyring, result)
/* Get the encryption context */
const { encryptionContext } = messageHeader
/* Verify that all values in the original encryption context are in the
* current one. (The Encryption SDK adds extra values for signing.)
*/
Object
.entries(context)
.forEach(([key, value]) => {
if (encryptionContext[key] !== value) throw new Error('Encryption Context does not match expected values')
})
/* If the encryption context is verified, return the plaintext. */
npm test
Node.js crypto does not support all RSA key wrapping options supported by other other implementation of the AWS Encryption SDK
The supported configurations are:
This SDK is distributed under the Apache License, Version 2.0, see LICENSE.txt and NOTICE.txt for more information.
FAQs
# @aws-crypto/client-node
The npm package @aws-crypto/client-node receives a total of 167,042 weekly downloads. As such, @aws-crypto/client-node popularity was classified as popular.
We found that @aws-crypto/client-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
In an open letter, JavaScript community leaders urge Oracle to give up the JavaScript trademark, arguing that it has been effectively abandoned through nonuse.
Security News
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.
Security News
Floating dependency ranges in npm can introduce instability and security risks into your project by allowing unverified or incompatible versions to be installed automatically, leading to unpredictable behavior and potential conflicts.