Introduction

When we discuss user authentication in an application, consequently, we already think about information security and how user data will be used and stored in the application.

Some security concepts and techniques are used such as encryption, hashing, and salting to obtain a higher level of security, but each one has its purpose and I will introduce the concepts, differences, and how it is used in practice in this article.

But what is the difference and when to apply each one?

Concept

The concepts and techniques are different so I will explain each one so you can use it in your application.

Encryption

Encryption is the process of converting data using an access key with the possibility of recovering it. Encryption is a two-way (bidirectional) process, that is, it is possible to encrypt data and decrypt the same data using the same access key. There are some types of encryption known like AES (Advanced Encryption Standard), RSA (Rivest-Shamir-Adleman), among others.

Hashing

Hashing is the process of converting data without needing to retrieve it, and hash types have the same length regardless of the converted data. Hashing is a one-way (unidirectional) process, that is, data can be encrypted but not decrypted. There are some types of hashing known like MD5, SHA1, SHA256, SHA512, among others.

Salting

Salting is the process of adding random data when converting data using hashing. There are some types of salting known as scrypt, bcrypt, Argon2, among others. This process is often used when storing passwords in the database.

Practice

The examples used in practice will be developed using Node.js and the crypto module.

Encryption

A practical example of encryption use is in the communication between two applications where application A encrypts the data and sends this encrypted data to application B, where this communication can be done by a database or by an HTTP request, and the application B decrypts the data for use. In this example, the access key must be in applications A and B.

There are two classes in the crypto module called Cipher and Decipher that we are going to use in the example.

1. Create the application folder.

mkdir nodejs-encryption
cd nodejs-encryption

2. Create the file package.json. The option -y allows the file to be created without the questions, such as application name, version, among others.

npm init -y

3. Create the folder src and create the file index.js inside the folder src.

mkdir src
touch src/index.js

4. Add the content below in the file src/index.js.

const { createCipheriv, createDecipheriv } = require('crypto');

const algorithm = 'aes-256-cbc';
const key = 'REtgV24bDB7xQYoMuypiBASMEaJbc59n';
const iv = '8d2bc3f0f69426fc';

const encrypt = (data) => {
  const cipher = createCipheriv(algorithm, key, iv);
  let crypted = cipher.update(data, 'utf8', 'hex');
  crypted += cipher.final('hex');
  return crypted;
};

const decrypt = (data) => {
  const decipher = createDecipheriv(algorithm, key, iv);
  let decrypted = decipher.update(data, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  return decrypted;
};

const data = 'Some data plain';

const dataEncrypt = encrypt(data);
const dataDecrypt = decrypt(dataEncrypt);

console.log(`Data=[${data}]`);
console.log(`Data encrypted=[${dataEncrypt}]`);
console.log(`Data decrypted=[${dataDecrypt}]`);

Notes:

5. Run the application with the command below.

node src/index.js 
Data=[Some data plain]
Data crypted=[4ee8b9fd43c94019edebafc2d6374c82]
Data decrypted=[Some data plain]

Notes:

6. Ready! We created an example of data encryption and decryption.

The application repository is available at https://github.com/rodrigokamada/nodejs-encryption.

Hashing

A practical example of hashing use is storing a user's password in a database by applying a hash type. Whenever the user enters the password on the sign-in page, the password hash is compared to the hash stored in the database.

There is a class in the crypto module called Hash that we are going to use in the example.

1. Create the application folder.

mkdir nodejs-hashing
cd nodejs-hashing

2. Create the file package.json. The option -y allows the file to be created without the questions, such as application name, version, among others.

npm init -y

3. Create the folder src and create the file index.js inside the folder src.

mkdir src
touch src/index.js

4. Add the content below in the file src/index.js.

const { createHash } = require('crypto');

const crypt = (data) => {
  const hash = createHash('sha256');
  hash.update(data);
  return hash.digest('hex');
};

const data = 'Some data plain';

const dataCrypt = crypt(data);

console.log(`Data=[${data}]`);
console.log(`Data crypted=[${dataCrypt}]`);

Notes:

5. Run the application with the command below.

node src/index.js 
Data=[Some data plain]
Data crypted=[039ee8ef355ee07c345fe6feaa22d6c1bf34ac91eb45abb80602c59deb5d34e7]

Note:

6. Ready! We created an example to convert the data to hash.

The application repository is available at https://github.com/rodrigokamada/nodejs-hashing.

Salting

A practical example of salting use is in storing the user's password in a database where random data is added with the password and then a type of hash is applied.

There is a method in the crypto module called scrypt that we are going to use in the example.

1. Create the application folder.

mkdir nodejs-salting
cd nodejs-salting

2. Create the file package.json. The option -y allows the file to be created without the questions, such as application name, version, among others.

npm init -y

3. Create the folder src and create the file index.js inside the folder src.

mkdir src
touch src/index.js

4. Add the content below in the file src/index.js.

const { scryptSync } = require('crypto');

const salt = 'some-salt';
const keyLength = 64;

const crypt = (data) => {
  const derivedKey = scryptSync(data, salt, keyLength);
  return derivedKey.toString('hex');
};

const data = 'Some data plain';

const dataCrypt = crypt(data);

console.log(`Data=[${data}]`);
console.log(`Data crypted=[${dataCrypt}]`);

Notes:

5. Run the application with the command below.

node src/index.js 
Data=[Some data plain]
Data crypted=[2b57498b290aa7d31741dc71b60f59f9b5f59431c842500502704f0d7e7b8204293b13bcb8ee54ef2f4f8c99711f27c42144d1c46d5c44362bd5a6748bf7a1bc]

Note:

6. Ready! We created an example to convert the data to hash using salt.

The application repository is available at https://github.com/rodrigokamada/nodejs-salting.

Conclusion

After presenting the concepts and the use in the practice of encryption, hashing, and salting, even if everything is related to security, each one has its purpose and to reinforce all this:

Understanding the security concepts and implementing the security techniques are very important to keep your application or system secure.

This tutorial was posted on my blog in Portuguese.