The evp_bytestokey package is a utility for deriving a key and IV from a password, mimicking the OpenSSL EVP_BytesToKey method. It is commonly used in cryptographic operations where a secure key needs to be generated from a password for encryption or decryption purposes.

What are evp_bytestokey's main functionalities?

Key and IV Generation

This feature allows the generation of a key and IV (Initialization Vector) from a given password and salt. It is useful for cryptographic operations where a secure key is needed. The example demonstrates how to use the package to generate a 256-bit key and a 128-bit IV from a password and salt.

const evp_bytestokey = require('evp_bytestokey');
const password = 'secret password';
const salt = 'salt';
const keyIv = evp_bytestokey(password, salt, 32, 16);
console.log(keyIv.key); // Buffer containing the key
console.log(keyIv.iv); // Buffer containing the IV

Other packages similar to evp_bytestokey

Readme

Source

EVP_BytesToKey

The insecure key derivation algorithm from OpenSSL.

WARNING: DO NOT USE, except for compatibility reasons.

MD5 is insecure.

Use at least scrypt or pbkdf2-hmac-sha256 instead.

API

EVP_BytesToKey(password, salt, keyLen, ivLen)

password - Buffer, password used to derive the key data.
salt - 8 byte Buffer or null, salt is used as a salt in the derivation.
keyBits - number, key length in bits.
ivLen - number, iv length in bytes.

Returns: { key: Buffer, iv: Buffer }

Examples

MD5 with aes-256-cbc:

const crypto = require('crypto')
const EVP_BytesToKey = require('evp_bytestokey')

const result = EVP_BytesToKey(
  'my-secret-password',
  null,
  32,
  16
)
// =>
// { key: <Buffer e3 4f 96 f3 86 24 82 7c c2 5d ff 23 18 6f 77 72 54 45 7f 49 d4 be 4b dd 4f 6e 1b cc 92 a4 27 33>,
//   iv: <Buffer 85 71 9a bf ae f4 1e 74 dd 46 b6 13 79 56 f5 5b> }

const cipher = crypto.createCipheriv('aes-256-cbc', result.key, result.iv)

LICENSE MIT

Keywords

FAQs

What is evp_bytestokey?

Is evp_bytestokey popular?

Is evp_bytestokey well maintained?

Last updated on 05 Sep 2017

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install