nodejs crypto module vs crypto-js

I'm quite new to NodeJs and trying to figure out how to use the "crypto" module. While playing around with it I notice the difference between the "crypto" module in NodeJs and crypto-js:

我对NodeJ很新,并试图弄清楚如何使用“加密”模块。在玩它时,我注意到NodeJs中的“crypto”模块和crypto-js之间的区别:

With crypto-js, I have:

使用crypto-js,我有:

function SHA256Hash(password, salt, iteration) {
    var saltedpassword = salt + password;
    var sha256 = CryptoJS.algo.SHA256.create();
    for(var i = 0; i < iteration; i++) {
            alert("saltedpassword = " + saltedpassword);
            sha256.update(saltedpassword);
            var saltedpassword = sha256.finalize();
            sha256.reset();
    }       
    return saltedpassword.toString(CryptoJS.enc.Base64);
}

Then call :

然后打电话:

var hashedPassword = SHA256Hash("123456789", "ASIN", 3)

And receive :

并收到:

saltedpassword = ASIN123456789
saltedpassword = 3362d80b757d14bfe18c01f6a003ed38a3a4a3dcab0417efb457b71740e21411
saltedpassword = 6020c992a9b7cd3ca9e95b9a3e21b64911edb7983b3dd77bdcecda19f2756987

With "crypto" module, I wrote:

使用“加密”模块,我写道:

function SHA256Hash(password, salt, iteration) {
    var saltedpassword = salt + password;
    for(var i = 0; i < iteration-1; i++) { 
            console.log("saltedpassword = "+saltedpassword)
            var sha256 = crypto.createHash('sha256');
            sha256.update(saltedpassword);
            var saltedpassword = sha256.digest('hex');
    }       
    console.log("saltedpassword = "+saltedpassword)
    var sha256 = crypto.createHash('sha256');
    sha256.update(saltedpassword);
    return sha256.digest('base64');
}

Then call:

var hashedPassword = SHA256Hash("123456789", "ASIN", 3);

And receive:

saltedpassword = ASIN123456789
saltedpassword = 3362d80b757d14bfe18c01f6a003ed38a3a4a3dcab0417efb457b71740e21411
saltedpassword = 4795d40ae8ae797f0ce51dfe4b496bca68f6d1f4a264f4ca52348ddd65a2988d

The first two items are the same but the third item is different. Did I miss out something ?

前两项是相同的,但第三项是不同的。我错过了什么吗?

Edited: As I compare to the Jasypt, CryptoJs generates similar keys. My question is how to tune "crypto" module to make it generate the same keys as CryptoJS and Jasypt do.

编辑:当我与Jasypt比较时,CryptoJs生成类似的键。我的问题是如何调整“加密”模块,使其生成与CryptoJS和Jasypt相同的密钥。

4 个解决方案

#1

Apparently I can't add comments to freakish's answer, so I'll write it here instead:

显然我无法为怪异的答案添加评论,所以我会在这里写下来:

reset() works fine. The significant difference is you're converting the hash output to a hex string within the iteration loop.

reset()工作正常。重要的区别是您在迭代循环中将散列输出转换为十六进制字符串。

#2

In the cryptojs example, finalize() returns raw binary data. In the crypto module example, digest() is returning a hex string. That difference in output means a difference in input when you iteratively re-hash.

在cryptojs示例中,finalize()返回原始二进制数据。在加密模块示例中,digest()返回一个十六进制字符串。输出的差异意味着迭代重新哈希时输入的差异。

#3

Use PKDF2 instead!

Why are you not using the built-in PBKDF2 from node-crypto:

为什么不使用node-crypto中的内置PBKDF2:

var hashedpw = crypto.pbkdf2Sync(password, salt, iterations, keysize);

and crypto-js:

var hashedpw = CryptoJS.PBKDF2(
    password, 
    salt, 
    { keySize: keysize/32, iterations: iterations }
);

Not only is it more secure than what you're trying to do by being much more expensive to compute than repeated hashing, it's also a lot easier to implement.

通过比重复散列更昂贵的计算,它不仅比你想要做的更安全,而且实现起来也容易得多。

#4

I've done some tests and apparently this reset function ( in crypto-js ) messes up. I'm not sure what it does and I don't have enough patience to look for an issue. :) However, here's the working solution:

我做了一些测试,显然这个重置功能(在crypto-js中)搞砸了。我不确定它的作用,我没有足够的耐心去寻找问题。 :)但是,这是工作解决方案:

function SHA256Encrypt(password, salt, iteration) {
    var saltedpassword = salt + password;
    for(var i = 0; i < iteration-1; i++) {
        alert("saltedpassword = " + saltedpassword);
        saltedpassword = CryptoJS.SHA256( saltedpassword ).toString( CryptoJS.enc.Hex );
    }
    saltedpassword = CryptoJS.SHA256( saltedpassword );
    return saltedpassword.toString(CryptoJS.enc.Base64);
}

which makes both codes even more similar, which is good.

这使得两个代码更加相似,这很好。