Cryptography

🔐 Node.js Cryptography: Your Secret Message Toolkit

Imagine you have a special box that can turn your secrets into scrambled puzzles that only your best friend can solve. That’s cryptography!

🎯 The Big Picture

Think of the crypto module in Node.js as your secret agent toolkit. Just like spies use special codes to send hidden messages, your computer uses cryptography to:

• Lock your passwords safely 🔒
• Make sure messages weren’t changed 📝
• Create secret codes only you can read 🕵️

Let’s open this toolkit and see what’s inside!

📦 1. The Crypto Module Overview

What Is It?

The crypto module is like a magic toolbox that comes built into Node.js. You don’t need to buy it or download it—it’s already there!

// Open your magic toolbox
const crypto = require('crypto');

What’s Inside?

🏠 2. Creating Hashes: The Fingerprint Machine

The Story

Imagine every person has a unique fingerprint. No two are the same! A hash works the same way—it takes any message and creates a unique “fingerprint” for it.

Real Life Example

When you type a password on a website, it doesn’t save “password123”. Instead, it saves the fingerprint: ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f

How To Create a Hash

const crypto = require('crypto');

// Create a fingerprint machine
const hash = crypto.createHash('sha256');

// Feed it your message
hash.update('Hello World');

// Get the fingerprint
const fingerprint = hash.digest('hex');

console.log(fingerprint);
// 'a591a6d40bf42040...'

Key Points

✅ Same message = Same fingerprint (always!) ✅ Different message = Different fingerprint ✅ Can’t reverse a fingerprint back to the message ✅ Even tiny changes create completely different fingerprints

🎨 3. Hash Algorithms: Choosing Your Fingerprint Style

The Story

Just like there are different ways to take a fingerprint (ink, digital scanner, etc.), there are different hash algorithms. Each creates fingerprints of different sizes.

Popular Algorithms

Example: Try Different Algorithms

const crypto = require('crypto');
const message = 'Secret Message';

// MD5 (old, don't use for security)
const md5 = crypto
  .createHash('md5')
  .update(message)
  .digest('hex');

// SHA-256 (recommended)
const sha256 = crypto
  .createHash('sha256')
  .update(message)
  .digest('hex');

console.log('MD5:', md5);
console.log('SHA-256:', sha256);

🎯 Which One Should I Use?

graph TD
    A["Need a Hash?"] --> B{What for?}
    B --> C["Passwords?"]
    B --> D["File Verification?"]
    B --> E["Tokens/IDs?"]
    C --> F["Use bcrypt or scrypt!"]
    D --> G["Use SHA-256"]
    E --> H["Use SHA-256"]

🎫 4. HMAC Authentication: The Stamp of Approval

The Story

Imagine you’re a king sending a letter. Anyone could write a fake letter pretending to be you! So you use a special wax seal that only you have. That’s HMAC!

HMAC = Hash + Secret Key = Proof that YOU sent it

How It Works

graph TD
    A["Your Message"] --> B["Add Secret Key"]
    B --> C["Create HMAC"]
    C --> D["Unique Stamp"]
    D --> E["Send Both Together"]

Code Example

const crypto = require('crypto');

// Your secret key (only you know this!)
const secretKey = 'my-super-secret-key';

// Your message
const message = 'Transfer $100 to Bob';

// Create the stamp
const hmac = crypto.createHmac('sha256', secretKey);
hmac.update(message);
const stamp = hmac.digest('hex');

console.log('Message:', message);
console.log('Stamp:', stamp);
// Anyone can verify this came from you!

Verifying a Message

function verifyMessage(message, stamp, key) {
  const hmac = crypto.createHmac('sha256', key);
  hmac.update(message);
  const expectedStamp = hmac.digest('hex');

  return stamp === expectedStamp;
}

// Check if message is real
const isReal = verifyMessage(
  'Transfer $100 to Bob',
  stamp,
  'my-super-secret-key'
);

console.log('Is authentic?', isReal); // true

🎲 5. Random Value Generation: The Dice Machine

The Story

When you roll a dice, you can’t predict the number. Computers need this randomness too! But computers are actually bad at being random—they follow rules. The crypto module has a special dice that creates truly unpredictable numbers.

Why Does It Matter?

• 🎟️ Creating unique session tokens
• 🔑 Generating temporary passwords
• 🎮 Making games fair
• 🔐 Creating encryption keys

Generate Random Bytes

const crypto = require('crypto');

// Get 16 random bytes
const randomBytes = crypto.randomBytes(16);

// As hex string (32 characters)
console.log(randomBytes.toString('hex'));
// 'a3f2b9c1d4e5f6a7b8c9d0e1f2a3b4c5'

// As base64 (22 characters)
console.log(randomBytes.toString('base64'));
// 'o/K5wdTl9qe4ydDh8qO0xQ=='

Generate Random Numbers

const crypto = require('crypto');

// Random number between 0 and 99
function randomNumber(max) {
  const bytes = crypto.randomBytes(4);
  const value = bytes.readUInt32BE(0);
  return value % max;
}

console.log(randomNumber(100)); // 0-99

🚫 Never Use Math.random() for Security!

// ❌ BAD - Predictable!
const bad = Math.random();

// ✅ GOOD - Truly random!
const good = crypto.randomBytes(32);

🔒 6. Password Hashing: The Super-Safe Lock

The Story

Regular hashes are fast. That’s actually a problem for passwords! If someone steals your hashed passwords, they can try billions of guesses per second.

Password hashing is like a lock that takes 1 second to open each time. For you, 1 second is fine. For a hacker trying millions of passwords? That’s years!

The Three Superheroes

Using pbkdf2

const crypto = require('crypto');

function hashPassword(password) {
  // Create random salt
  const salt = crypto.randomBytes(16).toString('hex');

  // Hash with 100,000 iterations
  const hash = crypto.pbkdf2Sync(
    password,    // Your password
    salt,        // Random salt
    100000,      // Iterations (slow!)
    64,          // Output length
    'sha512'     // Algorithm
  ).toString('hex');

  // Store both salt and hash
  return `${salt}:${hash}`;
}

const stored = hashPassword('myPassword123');
console.log(stored);

Verifying a Password

function verifyPassword(password, stored) {
  const [salt, originalHash] = stored.split(':');

  const hash = crypto.pbkdf2Sync(
    password,
    salt,
    100000,
    64,
    'sha512'
  ).toString('hex');

  return hash === originalHash;
}

const isCorrect = verifyPassword(
  'myPassword123',
  stored
);
console.log('Password correct?', isCorrect);

Using scrypt (Even Better!)

const crypto = require('crypto');

function hashWithScrypt(password) {
  const salt = crypto.randomBytes(16).toString('hex');

  const hash = crypto.scryptSync(
    password,
    salt,
    64  // Key length
  ).toString('hex');

  return `${salt}:${hash}`;
}

🔐 7. Symmetric Encryption: The Lock and Key

The Story

Imagine a treasure chest with a lock. You use the same key to lock it and unlock it. That’s symmetric encryption!

• 🔑 One key to lock (encrypt)
• 🔑 Same key to unlock (decrypt)

graph TD
    A["Secret Message"] --> B["Lock with Key 🔑"]
    B --> C["Scrambled Text"]
    C --> D["Unlock with Key 🔑"]
    D --> E["Secret Message"]

Encryption Example

const crypto = require('crypto');

function encrypt(text, password) {
  // Create a key from password
  const key = crypto.scryptSync(password, 'salt', 32);

  // Random starting point
  const iv = crypto.randomBytes(16);

  // Create the lock
  const cipher = crypto.createCipheriv(
    'aes-256-cbc',
    key,
    iv
  );

  // Lock the message
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');

  // Return IV + encrypted data
  return iv.toString('hex') + ':' + encrypted;
}

const secret = encrypt(
  'Meet me at midnight!',
  'super-secret-password'
);

console.log('Encrypted:', secret);

Decryption Example

function decrypt(encryptedData, password) {
  // Split IV and encrypted text
  const [ivHex, encrypted] = encryptedData.split(':');

  // Recreate the key
  const key = crypto.scryptSync(password, 'salt', 32);
  const iv = Buffer.from(ivHex, 'hex');

  // Create the unlock
  const decipher = crypto.createDecipheriv(
    'aes-256-cbc',
    key,
    iv
  );

  // Unlock the message
  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');

  return decrypted;
}

const message = decrypt(secret, 'super-secret-password');
console.log('Decrypted:', message);
// 'Meet me at midnight!'

Popular Encryption Algorithms

🎯 Quick Decision Guide

graph TD
    A["What do you need?"] --> B{Task Type}
    B --> C["Check if file changed?"]
    B --> D["Verify message sender?"]
    B --> E["Store passwords?"]
    B --> F["Hide secret data?"]
    B --> G["Generate unique ID?"]

    C --> H["Use SHA-256 Hash"]
    D --> I["Use HMAC"]
    E --> J["Use scrypt or pbkdf2"]
    F --> K["Use AES-256-GCM"]
    G --> L["Use randomBytes"]

🏆 Key Takeaways

1. Hashes = Unique fingerprints that can’t be reversed
2. HMAC = Hash + Secret Key = Proof of authenticity
3. Random Values = Truly unpredictable numbers for security
4. Password Hashing = Slow hashing that protects passwords
5. Symmetric Encryption = Lock and unlock with the same key

🚀 You Did It!

You now understand the secret agent toolkit of Node.js! These tools protect millions of users every day. With great power comes great responsibility—use them wisely! 🔐✨