I would like to make a safe way to store hashes of user passwords and verify them later. Here is crypt.js
:
'use strict'
const crypto = require('crypto')
module.exports = {
keyLength: 512,
hashAlg: 'sha512',
rounds: 10000,
randHex(length) {
return crypto.randomBytes(length / 2).toString('hex')
},
hashPassword(plainText) {
let salt = this.randHex(64)
let pbkdf2 = crypto.pbkdf2Sync(
plainText,
salt,
this.rounds,
this.keyLength,
this.hashAlg
).toString('hex')
return `${this.hashAlg}:${this.keyLength}:${this.rounds}:${salt}:${pbkdf2}`
},
verifyPassword(givenPassword, hashedPassword) {
let splits = hashedPassword.split(':')
let hashAlg = splits[0]
let keyLength = parseInt(splits[1])
let rounds = parseInt(splits[2])
let salt = splits[3]
let pbkdf2 = splits[4]
let testPbkdf2 = crypto.pbkdf2Sync(
givenPassword,
salt,
rounds,
keyLength,
hashAlg
).toString('hex')
return testPbkdf2 === pbkdf2
}
}
I have some questions.
It seems that
pbkdf2
might be the best that Node's Crypt offers. Is this true? If so, is there a good reason to avoidpbkdf2Sync
and usepbkdf2
instead?I am adding in a lot of info such as the salt, rounds, hashing algorithm, etc. so that I can change this stuff and still be able to verify passwords hashed the old way. The database will have someone's password as
sha512:512:10000:d15...d5k:a6a...1b9e
Is it okay to do this?What other dangers are there with
crypt.js
?