How to encrypt data that needs to be decrypted in Node js

Question

I’m building a Node.js application that requires data to be encrypted on the server and decrypted later. I’m looking for guidance on implementing secure encryption and decryption practices, especially for sensitive data storage. What’s the best approach to handle symmetric encryption in Node.js, and are there libraries that simplify the encryption process while maintaining security standards?

Any advice on best practices for encryption/decryption, key management, or library recommendations would be appreciated.

CaLLmeDaDDY · Answer 1 · Nov 6

To securely encrypt and decrypt data in a Node.js application, you can use the crypto module with AES encryption.

Here’s a recommended approach using AES-256-CBC encryption, which is commonly used and considered strong.

const crypto = require('crypto');
const assert = require('assert');

const algorithm = 'aes-256-cbc';
// Generate a 32-byte (256-bit) key and a 16-byte IV (AES block size)
const key = crypto.randomBytes(32);
const iv = crypto.randomBytes(16);

function encrypt(text) {
    const cipher = crypto.createCipheriv(algorithm, key, iv);
    let encrypted = cipher.update(text, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    return { iv: iv.toString('hex'), encryptedData: encrypted };
}

function decrypt(encryptedData, ivHex) {
    const decipher = crypto.createDecipheriv(algorithm, key, Buffer.from(ivHex, 'hex'));
    let decrypted = decipher.update(encryptedData, 'hex', 'utf8');
    decrypted += decipher.final('utf8');
    return decrypted;
}

// Usage example
const text = 'I love kittens';
const encrypted = encrypt(text);
console.log("Encrypted:", encrypted);

const decrypted = decrypt(encrypted.encryptedData, encrypted.iv);
console.log("Decrypted:", decrypted);

// Check if decrypted text matches the original
assert.strictEqual(decrypted, text);

The code specifies aes-256-cbc for AES encryption with a 256-bit key, a strong standard for secure encryption. This ensures data is encrypted with a secure algorithm.
A 32-byte key and a 16-byte initialization vector (IV) are randomly generated, which are crucial for encryption security. The IV makes each encryption unique, even with the same key.
createCipheriv is used to initialize encryption with the algorithm, key, and IV, then cipher.update and cipher.final convert the plaintext into encrypted hex data. This results in a securely encrypted message.
The decryption process reverses encryption using createDecipheriv, taking the encrypted data and IV to restore the original text. This verifies that only with the right key and IV can data be decrypted back to its original form.
An assert statement compares the decrypted text to the original, ensuring the encryption-decryption cycle is intact.

The implementation generates random keys and IVs, which is excellent for security. However, for practical applications, do you recommend using a secure secrets manager to store keys, and what strategies would you suggest for securely transferring IVs alongside encrypted data? — Anupam, Dec 6