Security News
New axobject-query Maintainer Faces Backlash Over Controversial Decision to Support Legacy Node.js Versions
A JavaScript library maintainer is under fire after merging a controversial PR to support legacy versions of Node.js.
derive-key
Advanced tools
Readme
Derive a named key from a high-entropy master key
npm install derive-key
const derive = require('derive-key')
const masterKey = crypto.randomBytes(32) // make sure this is high-entropy master key, eg. from a CSPRNG
const key = derive('a namespace', masterKey, 'my-named-key')
console.log('the derived key is:', key)
outputKey = derive(namespace, masterKey, name, [outputKey])
Derive a named key from a 32 byte high-entropy master key. This can be 32-bytes of cryptographically secure randomness, eg from a CSPRNG. Do NOT use low entropy soruces such a passwords, passphrases or randomness from a predictable RNG.
The namespace should be an ascii string (fx your application name) and name can be a buffer or string reflecting the name of the key you want to derive.
Optionally you can pass in the output key parameter and the result will be written into this buffer instead of a new buffer being allocated internally.
MIT
FAQs
Derive a named key from a master key
The npm package derive-key receives a total of 11 weekly downloads. As such, derive-key popularity was classified as not popular.
We found that derive-key demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A JavaScript library maintainer is under fire after merging a controversial PR to support legacy versions of Node.js.
Security News
Results from the 2023 State of JavaScript Survey highlight key trends, including Vite's dominance, rising TypeScript adoption, and the enduring popularity of React. Discover more insights on developer preferences and technology usage.
Security News
The US Justice Department has penalized two consulting firms $11.3 million for failing to meet cybersecurity requirements on federally funded projects, emphasizing strict enforcement to protect sensitive government data.