State of crypto in Node.js
summary
Helps decide by naming concrete changes and risks: Node relies on OpenSSL, supports AES-GCM and CCM (OCB and ChaCha20-Poly1305 land or land soon), key generation APIs land in v11 with backports to v10.12, pbkdf2 and scrypt exist, and RSA-PSS replaces older PKCS#1.5 signing. Avoid legacy APIs — createCipher deprecated because IV misuse breaks confidentiality — and always use randomBytes for IVs; use timingSafeEqual to avoid side‑channel leaks.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 2:30DISCLAIMER: What does crypto mean here
- 6:01Encryption: Illustration
- 6:30Encryption: Example
- 9:59Key Exchange: Illustration
- 16:02Hashing: Illustration
- 18:52Data Signing: Illustration
- 19:37Data Signing: Example
- 21:28Pseudo-random Number Generator
- 25:07Interoperability
- 28:42WebCrypto Compatibility
- 31:27Side-channel attacks
- 35:30Homecooked Crypto Hall of Shame
- 40:01OpenSSL
- 46:30Improvements to Authenticated Encryption
- 48:56Key Generation: Support Matrix
- 49:41createCipher and createDecipher deprecation
- 51:16Password-based Key Derivation Functions
related talks
29mMastering Cryptography with Node's crypto module
30mMastering Cryptography Fundamentals with Node’s crypto module
36mMastering Cryptography Fundamentals with Node's crypto module
26mRequire Cyrpto is a Human Right
25mCryptography Isn't Scary
26mJavascript Crypto. Ugly duckling with good reason?
27mState of Node.js Security
23mJS Bringing Crypto to the Masses