Skip to content

v2.0.0, update for modern nodejs

Latest
Compare
Choose a tag to compare
@bin-y bin-y released this 26 Apr 15:09

The default options.symmetricCypherName changed from aes-256-ecb to aes-128-ecb,
The default behavior of options.iv == null changed from to use crypto.createCipher to to use crypto.createCipheriv with an empty iv.
Updated to modern Buffer creation.

For the projects used this library with options.iv set to a valid iv buffer, no change is required to make compatible with 1.0.0. Other projects can set options.iv = undefined to make compatible with an older version.

In the version 1.0.0, it is advised to use a null iv for ECB mode ciphers, which will use crypto.createCipher -> EVP_BytesToKey to derive a key. However, as noted in the latest manual of EVP_BytesToKey that "Newer applications should use a more modern algorithm such as PBKDF2 as defined in PKCS#5v2.1 and provided by PKCS5_PBKDF2_HMAC", crypto.createCipher is deprecated by nodejs. Therefore, to avoid this library to use deprecated nodejs API by default, the behavior of options.iv == null now is to use crypto.createCipheriv with an empty iv to create the cipher which, however, is incompatible with the cipher created by crypto.createCipher.