Cryptography is scary. In this tutorial, we get hands-on with Node.js to learn how common crypto concepts work, like hashing, encryption, signing, and more https://fireship.io/lessons/node-crypto-examples/

🔗 Resources

Full Tutorial https://fireship.io/lessons/node-crypto-examples/
Source Code https://github.com/fireship-io/node-crypto-examples
Node Crypto https://nodejs.org/api/crypto.html

📚 Chapters

00:00 What is Cryptography
00:52 Brief History of Cryptography
01:41 1. Hash
04:07 2. Salt
05:47 3. HMAC
06:35 4. Symmetric Encryption.
08:19 5. Keypairs
09:29 6. Asymmetric Encryption
10:22 7. Signing
11:31 Hacking Challenge

🔥 Get More Content - Upgrade to PRO

Upgrade to Fireship PRO at https://fireship.io/pro
Use code lORhwXd2 for 25% off your first payment. 

🎨 My Editor Settings

- Atom One Dark 
- vscode-icons
- Fira Code Font

🔖 Topics Covered

- Cryptography for Developers Basics
- Crypto algorithms: SHA, MD5, argon2, scrypt
- How password salt works
- Encryption vs Signing
- Difference between Asymmetric vs Symmetric Encryption
- How hacking works and hacks are prevented
2024-02-04T05:41:10.998Z
nova-2
2-general-nova
2024-01-09.29447
30089e05-99d1-4376-b32e-c263170674af
5faa9491-5de3-4a3c-8595-373bd691568b
532f608687d65c49091a2db7977eb15007f84d5741bffcd12fdf837e16ee6804
67875a7f-c9c4-48a0-aa55-5bdb8a91c34a
deprecated
Cryptography is terrifying.
It's based on math that most of us don't understand, yet is the one thing that makes the Internet secure.
Without the mysterious art of cryptography, there would be no secrets and no privacy in the digital world.
Your emails, bank records, and browsing history would be easily hackable.
Computers, by design, do exactly what we tell them to do.
But sometimes, we don't want them to do certain things, like expose private data.
I'm sorry, Dave.
I'm afraid I can't do that,
cryptography can take some useful bytes of data, then scramble them up with an algorithm, making it nearly impossible for a computer to understand its true meaning without the proper credentials.
In today's video, we'll look at 7 useful crypto concepts that every developer should know and the best way to learn this stuff is to get Xon.
So we'll implement each concept in Node.
Js with its built in crypto module.
And make sure to stay tuned until the end because there's a challenge and the first person to solve it it's a free lifetime pro membership and t shirt.
Cryptography is the science of creating secrets, and has been around long before the computer.
It.
Before humans got good at math, they would tattoo secrets on the shaved head of a slave, then let their hair grow out to obfuscate it.
But there are some obvious vulnerabilities with this pattern.
An attacker could simply shave the head to access the message.
Things got much better by the time of Julius Caesar, who shifted the letters of the alphabet before passing messages to his military generals, creating what's known as the Caesar cipher.
Now, fast forward to 2025 and all the algorithms you're using today are made obsolete by super mega quantum computers that can crack them with brute force.
The point I'm making is that cryptography is always evolving.
What is considered safe and secure today may not be the case tomorrow.
Pro.
Luckily, as a developer, you don't need to understand all the complex math that goes into cryptography, but it is absolutely essential to understand how certain key concepts work, like, hashing, encryption, and signing, just to name a few.
The first concept we'll look at is the hash.
What is a hash?
The name sounds kind of intimidating to me, but the word itself actually has culinary roots meaning to chop and mix, and that perfectly describes what a hashing function does.
You start with an input, which can be any length, then pass it off to a hashing function.
This function returns a fixed length value of what looks like just meaningless garbage.
The important thing here is that the function will always produce the same output given the same input.
It needs to be fast to compute and unique.
However, it's extremely difficult for a computer to reverse engineer what the original message actually was.
These are really useful characteristics because it allows developers to store data without needing to know its true value.
The most simple example would be storing a password in the database, you wouldn't wanna store the real password because if a hacker gets a hold of that database, then they can immediately start putting those passwords to use.
But, if the data is hashed, then they have to also crack that hash to figure out what the true password is.
Let's go ahead and implement a hash in Node.
Js.
You can follow along with the source code on FireShip IO or GitHub, and all you need to get started is a JavaScript file with Node.
Js installed on your system.
The first thing we'll do is import the create hash function from nodecrypto, which is a module built 10 to node JS.
What I'll do next is define my own custom function called hash that takes a string as an input and returns a hash string as the output.
The first step is to define the hashing algorithm that you want to use.
I'm using sha256 here, which stands for secure hashing algorithm, them, and returns a hash value, which is also called a digest with 256 bits.
The algorithm you choose here is important.
In my last video, I carelessly used MD of 5 when hashing an API key.
And you guys were quick to call me out on it.
Fool this man.
As computers have become faster and the Internet more vast, MD 5 has become obsolete.
Remember, cryptography is always evolving.
SHA 256 is a good option, but there are even better solutions like Argon2, although it's not built into node crypto.
Once we have our hashing function, we can call update with the input value and then return an output by calling digest with the format that we want to return.
In this video, we'll be using hexadecimal format, but another option you'll commonly see is base 60 4.
Now that we have this function, we can pass it an input like a password and when you console log it, you get this long string of numbers and letters that hide its original meaning.
Now if we create another hash and compare the 2, we'll know that the original value is the same if the 2 hashes match up.
That's super useful, but a hash by itself isn't actually sufficient for storing a password in a database, and that brings us to our next topic, salt.
The fact that a hashing function always returns the same value is also a problem when it comes to passwords, especially when you let stupid humans come up with them, like password 123.
So the combination is 1, 2, 3, 4, 5.
That's the stupidest combination I ever heard in my life.
If a hacker obtains the database and the passwords are hashed, they can often just go to something like a rainbow table that has a bunch of pre computed hashes and find a bunch of commonly used passwords.
A salt is just a random value that's added to the password before it's hashed, therefore, making it much harder to guess.
In Node, we can hash a password with salt by importing sscript and the random bytes function.
Then we'll define functions, sign up and log in, that take an email and password as their arguments.
When the user signs up, we'll generate a salt, which is just a random set of characters.
Then we'll use s script to hash it.
We provide it with the original password and salt and provide a key length which is recommended to be of xd4.
Without going into details, sscript makes it more computationally intensive to crack with brute force, and it's actually been used as a proof of work algorithm used in cocurrency mining.
So now that we have a hash password, we also need to store the salt with it in the database and we can do that by just prepending it to the existing being separated by a semicolon.
Now when the user goes to log in, we can grab the salt from the database and recreate the original hash.
Now we could just compare the strings here, but as one added touch, I'm going to use the timing safe equal function from Nodecrypto, which can prevent I mean attacks, where a hacker measures the amount of time it takes to perform an operation to obtain information about the value.
This function helps prevent that type of attack.
It.
That's how basic email password authentication works on the web, but a related topic you might come across is hash based message authentication code or HMAC.
The quick definition is that it's a hash that also requires a password.
So the only person that can create the same hash signature must also have the corresponding password or key.
You.
An example is a JSON web token for authentication on the web.
When a user logs in on a trusted server, it generates a token with key, then the client and server can pass it back and forth, and the server can trust it because it knows that only someone with the secret key could have generated that hash signature.
Her.
In Node, we can import the create hmac function, then we'll define a secret key along with the message that we want to hash.
We can create a hash just like we did in first example, the only difference is that we also provide this key.
The important thing to notice here is that we get the same hash when the same password is used, but if a different password is used, we get an entirely different hash.
That's pretty cool, but what happens when you want to share a secret with someone, and also allow them to read the original message?
That's where encryption comes in.
What is encryption exactly?
With encryption, we take a message, scramble up the bytes to make it unreadable, that's called the ciphertext, then provide a key or password allowing somebody else to decrypt it.
It's also typically randomized, so that each time you encrypt, you get an entirely different encrypted output even if the key and message are the same.
The first encryption example we'll look at is symmetric, which means that there's a shared password that both the sender and receiver of the message we'll need.
To implement it in node, we're going to import create cipher IV, IV stands for initial vector by the way, along with random bytes and create decipher.
First, we have the message itself.
That's what we're trying to encrypt.
Then we'll define the key as 32 random bytes, and also the initial vector as 16 random bytes.
This will randomize the output when it's encrypted, so an identical sequence of text will never produce the exact same ciphertext, making it more difficult for a hacker to break the encryption.
Now, we can use these values to create a cipher.
Like a hash, it's dependent upon an algorithm, although encryption algorithms are inherently different than hashing algorithms.
So you'll notice an entirely different set of options here.
Now, you can use the Cypher to encrypt a message by calling update or even multiple messages if you want to, then finish it off by calling cypher final and add that value to the end of the encrypted message.
At this point, the cipher can no longer be used to encrypt data.
Now, to decipher it, create a decipher object with the same key and initial vector.
Use the same basic pattern with update and final to convert the encrypted message back into plain text, and that's how you encrypt and decrypt a message and note.
The world isn't run by weapons anymore or energy or money.
It's run by little ones and zeros, little bits of data.
It's all just electrons.
However, there is one big limitation with symmetric encryption, and that's the fact that both the sender and receiver of the message need to share a password.
It's just not very practical for 2 different parties to agree upon a shared password.
Once again, math comes to the rescue, this time in the form of a public key cryptosystem.
Instead of one key, it uses 2 keys that are mathematically linked, a public key and a private a key.
As the name suggests, the private key should always be kept secret while the public key can be shared with other people.
Think of it like a mailbox.
You have a slot where anybody can add mail into the box, that's your public key, but to get the mail out, you need the private key, which can only be done by the owner of the key.
In Node, we can generate a private and public key pair using the generate key pair function.
The first argument is the cryptosystem you wanna use, which in our case will be RSA.
That's the most common one that you'll come across.
From there, you can define a bunch of settings, like, the length of the key and bits and also the encoding for the public and private key.
We'll go with the recommended settings here and have it return a format of PEM to show us the keys in base 64 format.
You can also add a passphrase to your private key for added security.
If we go ahead and console log, we get values for the public and private keys.
Then I'll export them from this file to put them to use.
And that brings us to asymmetric encryption.
You use asymmetric encryption, anytime you go to a website using HTTPS, the browser will automatically find a public key of an SSL certificate installed on the sight.
That public key is used to encrypt any data that you send to the website.
That prevents hackers from gaining anything useful from it in transit.
Your where data is then decrypted with the private key by the trusted website.
The implementation in Node is very simple.
We import public encrypt and private decrypt from NodeCrypto along with the public key and private key that we generated previously.
We can then encrypt a message or put it in the mailbox by combining the public key with the message itself.
In this case, it needs to be in a buffer format.
That will encrypt it so that only the owner of the mailbox can read it.
At some point in the future, the recipient may want to read the original message, which can be done by calling private decrypt with the private key and the encrypted data.
Encryption is fun, but in many cases, you don't actually need to encrypt data, but rather validate that it came from a trusted party.
That's where signing comes in.
What is a digital signature?
Let's imagine you're expecting a letter in the mail with some sensitive information, you need to be able to trust that that letter came from the right person, so you require them to sign it in blood.
It also can't be tampered with, so they put a special seal on it that if broken will indicate that it's been tampered with.
Digital signatures work in the same basic way.
The sender of the message, we'll use their private key to sign a hash of the original message.
The private key guarantees authenticity, like blood, and the hash guarantees that the message can't be tampered with because it would produce an entirely different signature.
The recipient can then use the public key to validate the authenticity of the message.
In Node, we can create a signature with the create sign function, then pass it an algorithm that uses the RSA cryptosystem with sha 256 X4 hashing.
We then update it with the message that we want to sign and create the actual signature with the private key.
We can now attach the signature to the original message and send it to someone.
When they get it, they can create a verifier, update the original message, and then verify the signature with the sender's public key.
If the signature was forged or the message changed, the verifier will fail.
And that gives us 7 different cryptography concepts that I think every developer should know.
The final thing I'll leave you with is a challenge.
In the GitHub repo, there's a file called hack dotjs.
Inside it is a hash.
Use your hacking skills to crack it and put the answer below.
1st one to submit a pull request wins a free Lifetime Pro membership and t shirt.
If this video helped you, hit the like button and subscribe.
Thanks for watching and I will see you in the next one.

Speaker 0: Cryptography is terrifying. It's based on math that most of us don't understand, yet is the one thing that makes the Internet secure. Without the mysterious art of cryptography, there would be no secrets and no privacy in the digital world. Your emails, bank records, and browsing history would be easily hackable. Computers, by design, do exactly what we tell them to do.

But sometimes, we don't want them to do certain things, like expose private data.

Speaker 1: I'm sorry, Dave. I'm afraid I can't do that,

Speaker 0: cryptography can take some useful bytes of data, then scramble them up with an algorithm, making it nearly impossible for a computer to understand its true meaning without the proper credentials. In today's video, we'll look at 7 useful crypto concepts that every developer should know and the best way to learn this stuff is to get Xon. So we'll implement each concept in Node. Js with its built in crypto module. And make sure to stay tuned until the end because there's a challenge and the first person to solve it it's a free lifetime pro membership and t shirt.

Cryptography is the science of creating secrets, and has been around long before the computer. It. Before humans got good at math, they would tattoo secrets on the shaved head of a slave, then let their hair grow out to obfuscate it. But there are some obvious vulnerabilities with this pattern. An attacker could simply shave the head to access the message.

Things got much better by the time of Julius Caesar, who shifted the letters of the alphabet before passing messages to his military generals, creating what's known as the Caesar cipher. Now, fast forward to 2025 and all the algorithms you're using today are made obsolete by super mega quantum computers that can crack them with brute force. The point I'm making is that cryptography is always evolving. What is considered safe and secure today may not be the case tomorrow. Pro.

Luckily, as a developer, you don't need to understand all the complex math that goes into cryptography, but it is absolutely essential to understand how certain key concepts work, like, hashing, encryption, and signing, just to name a few. The first concept we'll look at is the hash. What is a hash? The name sounds kind of intimidating to me, but the word itself actually has culinary roots meaning to chop and mix, and that perfectly describes what a hashing function does. You start with an input, which can be any length, then pass it off to a hashing function.

This function returns a fixed length value of what looks like just meaningless garbage. The important thing here is that the function will always produce the same output given the same input. It needs to be fast to compute and unique. However, it's extremely difficult for a computer to reverse engineer what the original message actually was. These are really useful characteristics because it allows developers to store data without needing to know its true value.

The most simple example would be storing a password in the database, you wouldn't wanna store the real password because if a hacker gets a hold of that database, then they can immediately start putting those passwords to use. But, if the data is hashed, then they have to also crack that hash to figure out what the true password is. Let's go ahead and implement a hash in Node. Js. You can follow along with the source code on FireShip IO or GitHub, and all you need to get started is a JavaScript file with Node.

Js installed on your system. The first thing we'll do is import the create hash function from nodecrypto, which is a module built 10 to node JS. What I'll do next is define my own custom function called hash that takes a string as an input and returns a hash string as the output. The first step is to define the hashing algorithm that you want to use. I'm using sha256 here, which stands for secure hashing algorithm, them, and returns a hash value, which is also called a digest with 256 bits.

The algorithm you choose here is important. In my last video, I carelessly used MD of 5 when hashing an API key. And you guys were quick to call me out on it. Fool this man. As computers have become faster and the Internet more vast, MD 5 has become obsolete.

Remember, cryptography is always evolving. SHA 256 is a good option, but there are even better solutions like Argon2, although it's not built into node crypto. Once we have our hashing function, we can call update with the input value and then return an output by calling digest with the format that we want to return. In this video, we'll be using hexadecimal format, but another option you'll commonly see is base 60 4. Now that we have this function, we can pass it an input like a password and when you console log it, you get this long string of numbers and letters that hide its original meaning.

Now if we create another hash and compare the 2, we'll know that the original value is the same if the 2 hashes match up. That's super useful, but a hash by itself isn't actually sufficient for storing a password in a database, and that brings us to our next topic, salt. The fact that a hashing function always returns the same value is also a problem when it comes to passwords, especially when you let stupid humans come up with them, like password 123. So the combination is 1, 2, 3, 4, 5. That's the stupidest combination I ever heard in my life.

If a hacker obtains the database and the passwords are hashed, they can often just go to something like a rainbow table that has a bunch of pre computed hashes and find a bunch of commonly used passwords. A salt is just a random value that's added to the password before it's hashed, therefore, making it much harder to guess. In Node, we can hash a password with salt by importing sscript and the random bytes function. Then we'll define functions, sign up and log in, that take an email and password as their arguments. When the user signs up, we'll generate a salt, which is just a random set of characters.

Then we'll use s script to hash it. We provide it with the original password and salt and provide a key length which is recommended to be of xd4. Without going into details, sscript makes it more computationally intensive to crack with brute force, and it's actually been used as a proof of work algorithm used in cocurrency mining. So now that we have a hash password, we also need to store the salt with it in the database and we can do that by just prepending it to the existing being separated by a semicolon. Now when the user goes to log in, we can grab the salt from the database and recreate the original hash.

Now we could just compare the strings here, but as one added touch, I'm going to use the timing safe equal function from Nodecrypto, which can prevent I mean attacks, where a hacker measures the amount of time it takes to perform an operation to obtain information about the value. This function helps prevent that type of attack. It. That's how basic email password authentication works on the web, but a related topic you might come across is hash based message authentication code or HMAC. The quick definition is that it's a hash that also requires a password.

So the only person that can create the same hash signature must also have the corresponding password or key. You. An example is a JSON web token for authentication on the web. When a user logs in on a trusted server, it generates a token with key, then the client and server can pass it back and forth, and the server can trust it because it knows that only someone with the secret key could have generated that hash signature. Her.

In Node, we can import the create hmac function, then we'll define a secret key along with the message that we want to hash. We can create a hash just like we did in first example, the only difference is that we also provide this key. The important thing to notice here is that we get the same hash when the same password is used, but if a different password is used, we get an entirely different hash. That's pretty cool, but what happens when you want to share a secret with someone, and also allow them to read the original message? That's where encryption comes in.

What is encryption exactly? With encryption, we take a message, scramble up the bytes to make it unreadable, that's called the ciphertext, then provide a key or password allowing somebody else to decrypt it. It's also typically randomized, so that each time you encrypt, you get an entirely different encrypted output even if the key and message are the same. The first encryption example we'll look at is symmetric, which means that there's a shared password that both the sender and receiver of the message we'll need. To implement it in node, we're going to import create cipher IV, IV stands for initial vector by the way, along with random bytes and create decipher.

First, we have the message itself. That's what we're trying to encrypt. Then we'll define the key as 32 random bytes, and also the initial vector as 16 random bytes. This will randomize the output when it's encrypted, so an identical sequence of text will never produce the exact same ciphertext, making it more difficult for a hacker to break the encryption. Now, we can use these values to create a cipher.

Like a hash, it's dependent upon an algorithm, although encryption algorithms are inherently different than hashing algorithms. So you'll notice an entirely different set of options here. Now, you can use the Cypher to encrypt a message by calling update or even multiple messages if you want to, then finish it off by calling cypher final and add that value to the end of the encrypted message. At this point, the cipher can no longer be used to encrypt data. Now, to decipher it, create a decipher object with the same key and initial vector.

Use the same basic pattern with update and final to convert the encrypted message back into plain text, and that's how you encrypt and decrypt a message and note.

Speaker 1: The world isn't run by weapons anymore or energy or money. It's run by little ones and zeros, little bits of data. It's all just electrons.

Speaker 0: However, there is one big limitation with symmetric encryption, and that's the fact that both the sender and receiver of the message need to share a password. It's just not very practical for 2 different parties to agree upon a shared password. Once again, math comes to the rescue, this time in the form of a public key cryptosystem. Instead of one key, it uses 2 keys that are mathematically linked, a public key and a private a key. As the name suggests, the private key should always be kept secret while the public key can be shared with other people.

Think of it like a mailbox. You have a slot where anybody can add mail into the box, that's your public key, but to get the mail out, you need the private key, which can only be done by the owner of the key. In Node, we can generate a private and public key pair using the generate key pair function. The first argument is the cryptosystem you wanna use, which in our case will be RSA. That's the most common one that you'll come across.

From there, you can define a bunch of settings, like, the length of the key and bits and also the encoding for the public and private key. We'll go with the recommended settings here and have it return a format of PEM to show us the keys in base 64 format. You can also add a passphrase to your private key for added security. If we go ahead and console log, we get values for the public and private keys. Then I'll export them from this file to put them to use.

And that brings us to asymmetric encryption. You use asymmetric encryption, anytime you go to a website using HTTPS, the browser will automatically find a public key of an SSL certificate installed on the sight. That public key is used to encrypt any data that you send to the website. That prevents hackers from gaining anything useful from it in transit. Your where data is then decrypted with the private key by the trusted website.

The implementation in Node is very simple. We import public encrypt and private decrypt from NodeCrypto along with the public key and private key that we generated previously. We can then encrypt a message or put it in the mailbox by combining the public key with the message itself. In this case, it needs to be in a buffer format. That will encrypt it so that only the owner of the mailbox can read it.

At some point in the future, the recipient may want to read the original message, which can be done by calling private decrypt with the private key and the encrypted data. Encryption is fun, but in many cases, you don't actually need to encrypt data, but rather validate that it came from a trusted party. That's where signing comes in. What is a digital signature? Let's imagine you're expecting a letter in the mail with some sensitive information, you need to be able to trust that that letter came from the right person, so you require them to sign it in blood.

It also can't be tampered with, so they put a special seal on it that if broken will indicate that it's been tampered with. Digital signatures work in the same basic way. The sender of the message, we'll use their private key to sign a hash of the original message. The private key guarantees authenticity, like blood, and the hash guarantees that the message can't be tampered with because it would produce an entirely different signature. The recipient can then use the public key to validate the authenticity of the message.

In Node, we can create a signature with the create sign function, then pass it an algorithm that uses the RSA cryptosystem with sha 256 X4 hashing. We then update it with the message that we want to sign and create the actual signature with the private key. We can now attach the signature to the original message and send it to someone. When they get it, they can create a verifier, update the original message, and then verify the signature with the sender's public key. If the signature was forged or the message changed, the verifier will fail.

And that gives us 7 different cryptography concepts that I think every developer should know. The final thing I'll leave you with is a challenge. In the GitHub repo, there's a file called hack dotjs. Inside it is a hash. Use your hacking skills to crack it and put the answer below.

1st one to submit a pull request wins a free Lifetime Pro membership and t shirt. If this video helped you, hit the like button and subscribe. Thanks for watching and I will see you in the next one.
Cryptography is terrifying. It's based on math that most of us don't understand, yet is the one thing that makes the Internet secure. Without the mysterious art of cryptography, there would be no secrets and no privacy in the digital world. Your emails, bank records, and browsing history would be easily hackable. Computers, by design, do exactly what we tell them to do. But sometimes, we don't want them to do certain things, like expose private data. I'm sorry, Dave. I'm afraid I can't do that, cryptography can take some useful bytes of data, then scramble them up with an algorithm, making it nearly impossible for a computer to understand its true meaning without the proper credentials. In today's video, we'll look at 7 useful crypto concepts that every developer should know and the best way to learn this stuff is to get Xon. So we'll implement each concept in Node. Js with its built in crypto module. And make sure to stay tuned until the end because there's a challenge and the first person to solve it it's a free lifetime pro membership and t shirt. Cryptography is the science of creating secrets, and has been around long before the computer. It. Before humans got good at math, they would tattoo secrets on the shaved head of a slave, then let their hair grow out to obfuscate it. But there are some obvious vulnerabilities with this pattern.
cryptocurrency
computer science
security
deep learning
An attacker could simply shave the head to access the message. Things got much better by the time of Julius Caesar, who shifted the letters of the alphabet before passing messages to his military generals, creating what's known as the Caesar cipher.
Now, fast forward to 2025 and all the algorithms you're using today are made obsolete by super mega quantum computers that can crack them with brute force. The point I'm making is that cryptography is always evolving. What is considered safe and secure today may not be the case tomorrow. Pro. Luckily, as a developer, you don't need to understand all the complex math that goes into cryptography, but it is absolutely essential to understand how certain key concepts work, like, hashing, encryption, and signing, just to name a few.
cryptocurrency
security
The first concept we'll look at is the hash. What is a hash? The name sounds kind of intimidating to me, but the word itself actually has culinary roots meaning to chop and mix, and that perfectly describes what a hashing function does. You start with an input, which can be any length, then pass it off to a hashing function. This function returns a fixed length value of what looks like just meaningless garbage.
The important thing here is that the function will always produce the same output given the same input. It needs to be fast to compute and unique. However, it's extremely difficult for a computer to reverse engineer what the original message actually was. These are really useful characteristics because it allows developers to store data without needing to know its true value. The most simple example would be storing a password in the database, you wouldn't wanna store the real password because if a hacker gets a hold of that database, then they can immediately start putting those passwords to use.
programming
computer science
But, if the data is hashed, then they have to also crack that hash to figure out what the true password is. Let's go ahead and implement a hash in Node. Js. You can follow along with the source code on FireShip IO or GitHub, and all you need to get started is a JavaScript file with Node. Js installed on your system. The first thing we'll do is import the create hash function from nodecrypto, which is a module built 10 to node JS. What I'll do next is define my own custom function called hash that takes a string as an input and returns a hash string as the output. The first step is to define the hashing algorithm that you want to use. I'm using sha256 here, which stands for secure hashing algorithm, them, and returns a hash value, which is also called a digest with 256 bits. The algorithm you choose here is important. In my last video, I carelessly used MD of 5 when hashing an API key. And you guys were quick to call me out on it.
Fool this man. As computers have become faster and the Internet more vast, MD 5 has become obsolete. Remember, cryptography is always evolving. SHA 256 is a good option, but there are even better solutions like Argon2, although it's not built into node crypto. Once we have our hashing function, we can call update with the input value and then return an output by calling digest with the format that we want to return.
cryptocurrency
In this video, we'll be using hexadecimal format, but another option you'll commonly see is base 60 4. Now that we have this function, we can pass it an input like a password and when you console log it, you get this long string of numbers and letters that hide its original meaning. Now if we create another hash and compare the 2, we'll know that the original value is the same if the 2 hashes match up. That's super useful, but a hash by itself isn't actually sufficient for storing a password in a database, and that brings us to our next topic, salt. The fact that a hashing function always returns the same value is also a problem when it comes to passwords, especially when you let stupid humans come up with them, like password 123.
So the combination is 1, 2, 3, 4, 5. That's the stupidest combination I ever heard in my life. If a hacker obtains the database and the passwords are hashed, they can often just go to something like a rainbow table that has a bunch of pre computed hashes and find a bunch of commonly used passwords.
databases
A salt is just a random value that's added to the password before it's hashed, therefore, making it much harder to guess. In Node, we can hash a password with salt by importing sscript and the random bytes function. Then we'll define functions, sign up and log in, that take an email and password as their arguments. When the user signs up, we'll generate a salt, which is just a random set of characters.
Then we'll use s script to hash it. We provide it with the original password and salt and provide a key length which is recommended to be of xd4. Without going into details, sscript makes it more computationally intensive to crack with brute force, and it's actually been used as a proof of work algorithm used in cocurrency mining. So now that we have a hash password, we also need to store the salt with it in the database and we can do that by just prepending it to the existing being separated by a semicolon.
security
Now when the user goes to log in, we can grab the salt from the database and recreate the original hash. Now we could just compare the strings here, but as one added touch, I'm going to use the timing safe equal function from Nodecrypto, which can prevent I mean attacks, where a hacker measures the amount of time it takes to perform an operation to obtain information about the value.
This function helps prevent that type of attack. It. That's how basic email password authentication works on the web, but a related topic you might come across is hash based message authentication code or HMAC. The quick definition is that it's a hash that also requires a password. So the only person that can create the same hash signature must also have the corresponding password or key. You. An example is a JSON web token for authentication on the web. When a user logs in on a trusted server, it generates a token with key, then the client and server can pass it back and forth, and the server can trust it because it knows that only someone with the secret key could have generated that hash signature.
security
cryptocurrency
Her. In Node, we can import the create hmac function, then we'll define a secret key along with the message that we want to hash. We can create a hash just like we did in first example, the only difference is that we also provide this key. The important thing to notice here is that we get the same hash when the same password is used, but if a different password is used, we get an entirely different hash.
That's pretty cool, but what happens when you want to share a secret with someone, and also allow them to read the original message? That's where encryption comes in. What is encryption exactly? With encryption, we take a message, scramble up the bytes to make it unreadable, that's called the ciphertext, then provide a key or password allowing somebody else to decrypt it. It's also typically randomized, so that each time you encrypt, you get an entirely different encrypted output even if the key and message are the same.
cryptocurrency
security
The first encryption example we'll look at is symmetric, which means that there's a shared password that both the sender and receiver of the message we'll need. To implement it in node, we're going to import create cipher IV, IV stands for initial vector by the way, along with random bytes and create decipher.
security
First, we have the message itself. That's what we're trying to encrypt. Then we'll define the key as 32 random bytes, and also the initial vector as 16 random bytes. This will randomize the output when it's encrypted, so an identical sequence of text will never produce the exact same ciphertext, making it more difficult for a hacker to break the encryption.
Now, we can use these values to create a cipher. Like a hash, it's dependent upon an algorithm, although encryption algorithms are inherently different than hashing algorithms. So you'll notice an entirely different set of options here. Now, you can use the Cypher to encrypt a message by calling update or even multiple messages if you want to, then finish it off by calling cypher final and add that value to the end of the encrypted message.
cryptocurrency
At this point, the cipher can no longer be used to encrypt data. Now, to decipher it, create a decipher object with the same key and initial vector.
Use the same basic pattern with update and final to convert the encrypted message back into plain text, and that's how you encrypt and decrypt a message and note. The world isn't run by weapons anymore or energy or money. It's run by little ones and zeros, little bits of data. It's all just electrons. However, there is one big limitation with symmetric encryption, and that's the fact that both the sender and receiver of the message need to share a password. It's just not very practical for 2 different parties to agree upon a shared password. Once again, math comes to the rescue, this time in the form of a public key cryptosystem. Instead of one key, it uses 2 keys that are mathematically linked, a public key and a private a key.
cryptocurrency
security
As the name suggests, the private key should always be kept secret while the public key can be shared with other people. Think of it like a mailbox. You have a slot where anybody can add mail into the box, that's your public key, but to get the mail out, you need the private key, which can only be done by the owner of the key. In Node, we can generate a private and public key pair using the generate key pair function. The first argument is the cryptosystem you wanna use, which in our case will be RSA. That's the most common one that you'll come across. From there, you can define a bunch of settings, like, the length of the key and bits and also the encoding for the public and private key. We'll go with the recommended settings here and have it return a format of PEM to show us the keys in base 64 format. You can also add a passphrase to your private key for added security.
If we go ahead and console log, we get values for the public and private keys. Then I'll export them from this file to put them to use. And that brings us to asymmetric encryption. You use asymmetric encryption, anytime you go to a website using HTTPS, the browser will automatically find a public key of an SSL certificate installed on the sight. That public key is used to encrypt any data that you send to the website. That prevents hackers from gaining anything useful from it in transit. Your where data is then decrypted with the private key by the trusted website. The implementation in Node is very simple. We import public encrypt and private decrypt from NodeCrypto along with the public key and private key that we generated previously.
security
We can then encrypt a message or put it in the mailbox by combining the public key with the message itself. In this case, it needs to be in a buffer format.
That will encrypt it so that only the owner of the mailbox can read it. At some point in the future, the recipient may want to read the original message, which can be done by calling private decrypt with the private key and the encrypted data. Encryption is fun, but in many cases, you don't actually need to encrypt data, but rather validate that it came from a trusted party. That's where signing comes in. What is a digital signature? Let's imagine you're expecting a letter in the mail with some sensitive information, you need to be able to trust that that letter came from the right person, so you require them to sign it in blood.
cryptocurrency
It also can't be tampered with, so they put a special seal on it that if broken will indicate that it's been tampered with. Digital signatures work in the same basic way. The sender of the message, we'll use their private key to sign a hash of the original message. The private key guarantees authenticity, like blood, and the hash guarantees that the message can't be tampered with because it would produce an entirely different signature.
The recipient can then use the public key to validate the authenticity of the message. In Node, we can create a signature with the create sign function, then pass it an algorithm that uses the RSA cryptosystem with sha 256 X4 hashing. We then update it with the message that we want to sign and create the actual signature with the private key.
security
We can now attach the signature to the original message and send it to someone. When they get it, they can create a verifier, update the original message, and then verify the signature with the sender's public key. If the signature was forged or the message changed, the verifier will fail.
And that gives us 7 different cryptography concepts that I think every developer should know. The final thing I'll leave you with is a challenge. In the GitHub repo, there's a file called hack dotjs. Inside it is a hash. Use your hacking skills to crack it and put the answer below.
software
cryptocurrency
software development
1st one to submit a pull request wins a free Lifetime Pro membership and t shirt. If this video helped you, hit the like button and subscribe. Thanks for watching and I will see you in the next one.
twitter
social media
Cryptography is terrifying. It's based on math that most of us don't understand, yet is the one thing that makes the Internet secure. Without the mysterious art of cryptography, there would be no secrets and no privacy in the digital world. Your emails, bank records, and browsing history would be easily hackable. Computers, by design, do exactly what we tell them to do. But sometimes, we don't want them to do certain things, like expose private data. I'm sorry, Dave. I'm afraid I can't do that, cryptography can take some useful bytes of data, then scramble them up with an algorithm, making it nearly impossible for a computer to understand its true meaning without the proper credentials. In today's video, we'll look at 7 useful crypto concepts that every developer should know and the best way to learn this stuff is to get Xon. So we'll implement each concept in Node. Js with its built in crypto module. And make sure to stay tuned until the end because there's a challenge and the first person to solve it it's a free lifetime pro membership and t shirt. Cryptography is the science of creating secrets, and has been around long before the computer. It. Before humans got good at math, they would tattoo secrets on the shaved head of a slave, then let their hair grow out to obfuscate it. But there are some obvious vulnerabilities with this pattern. An attacker could simply shave the head to access the message. Things got much better by the time of Julius Caesar, who shifted the letters of the alphabet before passing messages to his military generals, creating what's known as the Caesar cipher. Now, fast forward to 2025 and all the algorithms you're using today are made obsolete by super mega quantum computers that can crack them with brute force. The point I'm making is that cryptography is always evolving. What is considered safe and secure today may not be the case tomorrow. Pro. Luckily, as a developer, you don't need to understand all the complex math that goes into cryptography, but it is absolutely essential to understand how certain key concepts work, like, hashing, encryption, and signing, just to name a few. The first concept we'll look at is the hash. What is a hash? The name sounds kind of intimidating to me, but the word itself actually has culinary roots meaning to chop and mix, and that perfectly describes what a hashing function does. You start with an input, which can be any length, then pass it off to a hashing function. This function returns a fixed length value of what looks like just meaningless garbage. The important thing here is that the function will always produce the same output given the same input. It needs to be fast to compute and unique. However, it's extremely difficult for a computer to reverse engineer what the original message actually was. These are really useful characteristics because it allows developers to store data without needing to know its true value. The most simple example would be storing a password in the database, you wouldn't wanna store the real password because if a hacker gets a hold of that database, then they can immediately start putting those passwords to use. But, if the data is hashed, then they have to also crack that hash to figure out what the true password is. Let's go ahead and implement a hash in Node. Js. You can follow along with the source code on FireShip IO or GitHub, and all you need to get started is a JavaScript file with Node. Js installed on your system. The first thing we'll do is import the create hash function from nodecrypto, which is a module built 10 to node JS. What I'll do next is define my own custom function called hash that takes a string as an input and returns a hash string as the output. The first step is to define the hashing algorithm that you want to use. I'm using sha256 here, which stands for secure hashing algorithm, them, and returns a hash value, which is also called a digest with 256 bits. The algorithm you choose here is important. In my last video, I carelessly used MD of 5 when hashing an API key. And you guys were quick to call me out on it. Fool this man. As computers have become faster and the Internet more vast, MD 5 has become obsolete. Remember, cryptography is always evolving. SHA 256 is a good option, but there are even better solutions like Argon2, although it's not built into node crypto. Once we have our hashing function, we can call update with the input value and then return an output by calling digest with the format that we want to return. In this video, we'll be using hexadecimal format, but another option you'll commonly see is base 60 4. Now that we have this function, we can pass it an input like a password and when you console log it, you get this long string of numbers and letters that hide its original meaning. Now if we create another hash and compare the 2, we'll know that the original value is the same if the 2 hashes match up. That's super useful, but a hash by itself isn't actually sufficient for storing a password in a database, and that brings us to our next topic, salt. The fact that a hashing function always returns the same value is also a problem when it comes to passwords, especially when you let stupid humans come up with them, like password 123. So the combination is 1, 2, 3, 4, 5. That's the stupidest combination I ever heard in my life. If a hacker obtains the database and the passwords are hashed, they can often just go to something like a rainbow table that has a bunch of pre computed hashes and find a bunch of commonly used passwords. A salt is just a random value that's added to the password before it's hashed, therefore, making it much harder to guess. In Node, we can hash a password with salt by importing sscript and the random bytes function. Then we'll define functions, sign up and log in, that take an email and password as their arguments. When the user signs up, we'll generate a salt, which is just a random set of characters. Then we'll use s script to hash it. We provide it with the original password and salt and provide a key length which is recommended to be of xd4. Without going into details, sscript makes it more computationally intensive to crack with brute force, and it's actually been used as a proof of work algorithm used in cocurrency mining. So now that we have a hash password, we also need to store the salt with it in the database and we can do that by just prepending it to the existing being separated by a semicolon. Now when the user goes to log in, we can grab the salt from the database and recreate the original hash. Now we could just compare the strings here, but as one added touch, I'm going to use the timing safe equal function from Nodecrypto, which can prevent I mean attacks, where a hacker measures the amount of time it takes to perform an operation to obtain information about the value. This function helps prevent that type of attack. It. That's how basic email password authentication works on the web, but a related topic you might come across is hash based message authentication code or HMAC. The quick definition is that it's a hash that also requires a password. So the only person that can create the same hash signature must also have the corresponding password or key. You. An example is a JSON web token for authentication on the web. When a user logs in on a trusted server, it generates a token with key, then the client and server can pass it back and forth, and the server can trust it because it knows that only someone with the secret key could have generated that hash signature. Her. In Node, we can import the create hmac function, then we'll define a secret key along with the message that we want to hash. We can create a hash just like we did in first example, the only difference is that we also provide this key. The important thing to notice here is that we get the same hash when the same password is used, but if a different password is used, we get an entirely different hash. That's pretty cool, but what happens when you want to share a secret with someone, and also allow them to read the original message? That's where encryption comes in. What is encryption exactly? With encryption, we take a message, scramble up the bytes to make it unreadable, that's called the ciphertext, then provide a key or password allowing somebody else to decrypt it. It's also typically randomized, so that each time you encrypt, you get an entirely different encrypted output even if the key and message are the same. The first encryption example we'll look at is symmetric, which means that there's a shared password that both the sender and receiver of the message we'll need. To implement it in node, we're going to import create cipher IV, IV stands for initial vector by the way, along with random bytes and create decipher. First, we have the message itself. That's what we're trying to encrypt. Then we'll define the key as 32 random bytes, and also the initial vector as 16 random bytes. This will randomize the output when it's encrypted, so an identical sequence of text will never produce the exact same ciphertext, making it more difficult for a hacker to break the encryption. Now, we can use these values to create a cipher. Like a hash, it's dependent upon an algorithm, although encryption algorithms are inherently different than hashing algorithms. So you'll notice an entirely different set of options here. Now, you can use the Cypher to encrypt a message by calling update or even multiple messages if you want to, then finish it off by calling cypher final and add that value to the end of the encrypted message. At this point, the cipher can no longer be used to encrypt data. Now, to decipher it, create a decipher object with the same key and initial vector. Use the same basic pattern with update and final to convert the encrypted message back into plain text, and that's how you encrypt and decrypt a message and note. The world isn't run by weapons anymore or energy or money. It's run by little ones and zeros, little bits of data. It's all just electrons. However, there is one big limitation with symmetric encryption, and that's the fact that both the sender and receiver of the message need to share a password. It's just not very practical for 2 different parties to agree upon a shared password. Once again, math comes to the rescue, this time in the form of a public key cryptosystem. Instead of one key, it uses 2 keys that are mathematically linked, a public key and a private a key. As the name suggests, the private key should always be kept secret while the public key can be shared with other people. Think of it like a mailbox. You have a slot where anybody can add mail into the box, that's your public key, but to get the mail out, you need the private key, which can only be done by the owner of the key. In Node, we can generate a private and public key pair using the generate key pair function. The first argument is the cryptosystem you wanna use, which in our case will be RSA. That's the most common one that you'll come across. From there, you can define a bunch of settings, like, the length of the key and bits and also the encoding for the public and private key. We'll go with the recommended settings here and have it return a format of PEM to show us the keys in base 64 format. You can also add a passphrase to your private key for added security. If we go ahead and console log, we get values for the public and private keys. Then I'll export them from this file to put them to use. And that brings us to asymmetric encryption. You use asymmetric encryption, anytime you go to a website using HTTPS, the browser will automatically find a public key of an SSL certificate installed on the sight. That public key is used to encrypt any data that you send to the website. That prevents hackers from gaining anything useful from it in transit. Your where data is then decrypted with the private key by the trusted website. The implementation in Node is very simple. We import public encrypt and private decrypt from NodeCrypto along with the public key and private key that we generated previously. We can then encrypt a message or put it in the mailbox by combining the public key with the message itself. In this case, it needs to be in a buffer format. That will encrypt it so that only the owner of the mailbox can read it. At some point in the future, the recipient may want to read the original message, which can be done by calling private decrypt with the private key and the encrypted data. Encryption is fun, but in many cases, you don't actually need to encrypt data, but rather validate that it came from a trusted party. That's where signing comes in. What is a digital signature? Let's imagine you're expecting a letter in the mail with some sensitive information, you need to be able to trust that that letter came from the right person, so you require them to sign it in blood. It also can't be tampered with, so they put a special seal on it that if broken will indicate that it's been tampered with. Digital signatures work in the same basic way. The sender of the message, we'll use their private key to sign a hash of the original message. The private key guarantees authenticity, like blood, and the hash guarantees that the message can't be tampered with because it would produce an entirely different signature. The recipient can then use the public key to validate the authenticity of the message. In Node, we can create a signature with the create sign function, then pass it an algorithm that uses the RSA cryptosystem with sha 256 X4 hashing. We then update it with the message that we want to sign and create the actual signature with the private key. We can now attach the signature to the original message and send it to someone. When they get it, they can create a verifier, update the original message, and then verify the signature with the sender's public key. If the signature was forged or the message changed, the verifier will fail. And that gives us 7 different cryptography concepts that I think every developer should know. The final thing I'll leave you with is a challenge. In the GitHub repo, there's a file called hack dotjs. Inside it is a hash. Use your hacking skills to crack it and put the answer below. 1st one to submit a pull request wins a free Lifetime Pro membership and t shirt. If this video helped you, hit the like button and subscribe. Thanks for watching and I will see you in the next one.
Cryptography
cryptography
is
is
terrifying.
terrifying
It's
it's
based
based
on
on
math
math
that
that
most
most
of
of
us
us
don't
don't
understand,
understand
yet
yet
is
is
the
the
one
one
thing
thing
that
that
makes
makes
the
the
Internet
internet
secure.
secure
Without
without
the
the
mysterious
mysterious
art
art
of
of
cryptography,
cryptography
there
there
would
would
be
be
no
no
secrets
secrets
and
and
no
no
privacy
privacy
in
in
the
the
digital
digital
world.
world
Your
your
emails,
emails
bank
bank
records,
records
and
and
browsing
browsing
history
history
would
would
be
be
easily
easily
hackable.
hackable
Computers,
computers
by
by
design,
design
do
do
exactly
exactly
what
what
we
we
tell
tell
them
them
to
to
do.
do
But
but
sometimes,
sometimes
we
we
don't
don't
want
want
them
them
to
to
do
do
certain
certain
things,
things
like
like
expose
expose
private
private
data.
data
I'm
i'm
sorry,
sorry
Dave.
dave
I'm
i'm
afraid
afraid
I
i
can't
can't
do
do
that,
that
cryptography
cryptography
can
can
take
take
some
some
useful
useful
bytes
bytes
of
of
data,
data
then
then
scramble
scramble
them
them
up
up
with
with
an
an
algorithm,
algorithm
making
making
it
it
nearly
nearly
impossible
impossible
for
for
a
a
computer
computer
to
to
understand
understand
its
its
true
true
meaning
meaning
without
without
the
the
proper
proper
credentials.
credentials
In
in
today's
today's
video,
video
we'll
we'll
look
look
at
at
7
7
useful
useful
crypto
crypto
concepts
concepts
that
that
every
every
developer
developer
should
should
know
know
and
and
the
the
best
best
way
way
to
to
learn
learn
this
this
stuff
stuff
is
is
to
to
get
get
Xon.
xon
So
so
we'll
we'll
implement
implement
each
each
concept
concept
in
in
Node.
node
Js
js
with
with
its
its
built
built
in
in
crypto
crypto
module.
module
And
and
make
make
sure
sure
to
to
stay
stay
tuned
tuned
until
until
the
the
end
end
because
because
there's
there's
a
a
challenge
challenge
and
and
the
the
first
first
person
person
to
to
solve
solve
it
it
it's
it's
a
a
free
free
lifetime
lifetime
pro
pro
membership
membership
and
and
t
t
shirt.
shirt
Cryptography
cryptography
is
is
the
the
science
science
of
of
creating
creating
secrets,
secrets
and
and
has
has
been
been
around
around
long
long
before
before
the
the
computer.
computer
It.
it
Before
before
humans
humans
got
got
good
good
at
at
math,
math
they
they
would
would
tattoo
tattoo
secrets
secrets
on
on
the
the
shaved
shaved
head
head
of
of
a
a
slave,
slave
then
then
let
let
their
their
hair
hair
grow
grow
out
out
to
to
obfuscate
obfuscate
it.
it
But
but
there
there
are
are
some
some
obvious
obvious
vulnerabilities
vulnerabilities
with
with
this
this
pattern.
pattern
An
an
attacker
attacker
could
could
simply
simply
shave
shave
the
the
head
head
to
to
access
access
the
the
message.
message
Things
things
got
got
much
much
better
better
by
by
the
the
time
time
of
of
Julius
julius
Caesar,
caesar
who
who
shifted
shifted
the
the
letters
letters
of
of
the
the
alphabet
alphabet
before
before
passing
passing
messages
messages
to
to
his
his
military
military
generals,
generals
creating
creating
what's
what's
known
known
as
as
the
the
Caesar
caesar
cipher.
cipher
Now,
now
fast
fast
forward
forward
to
to
2025
2025
and
and
all
all
the
the
algorithms
algorithms
you're
you're
using
using
today
today
are
are
made
made
obsolete
obsolete
by
by
super
super
mega
mega
quantum
quantum
computers
computers
that
that
can
can
crack
crack
them
them
with
with
brute
brute
force.
force
The
the
point
point
I'm
i'm
making
making
is
is
that
that
cryptography
cryptography
is
is
always
always
evolving.
evolving
What
what
is
is
considered
considered
safe
safe
and
and
secure
secure
today
today
may
may
not
not
be
be
the
the
case
case
tomorrow.
tomorrow
Pro.
pro
Luckily,
luckily
as
as
a
a
developer,
developer
you
you
don't
don't
need
need
to
to
understand
understand
all
all
the
the
complex
complex
math
math
that
that
goes
goes
into
into
cryptography,
cryptography
but
but
it
it
is
is
absolutely
absolutely
essential
essential
to
to
understand
understand
how
how
certain
certain
key
key
concepts
concepts
work,
work
like,
like
hashing,
hashing
encryption,
encryption
and
and
signing,
signing
just
just
to
to
name
name
a
a
few.
few
The
the
first
first
concept
concept
we'll
we'll
look
look
at
at
is
is
the
the
hash.
hash
What
what
is
is
a
a
hash?
hash
The
the
name
name
sounds
sounds
kind
kind
of
of
intimidating
intimidating
to
to
me,
me
but
but
the
the
word
word
itself
itself
actually
actually
has
has
culinary
culinary
roots
roots
meaning
meaning
to
to
chop
chop
and
and
mix,
mix
and
and
that
that
perfectly
perfectly
describes
describes
what
what
a
a
hashing
hashing
function
function
does.
does
You
you
start
start
with
with
an
an
input,
input
which
which
can
can
be
be
any
any
length,
length
then
then
pass
pass
it
it
off
off
to
to
a
a
hashing
hashing
function.
function
This
this
function
function
returns
returns
a
a
fixed
fixed
length
length
value
value
of
of
what
what
looks
looks
like
like
just
just
meaningless
meaningless
garbage.
garbage
The
the
important
important
thing
thing
here
here
is
is
that
that
the
the
function
function
will
will
always
always
produce
produce
the
the
same
same
output
output
given
given
the
the
same
same
input.
input
It
it
needs
needs
to
to
be
be
fast
fast
to
to
compute
compute
and
and
unique.
unique
However,
however
it's
it's
extremely
extremely
difficult
difficult
for
for
a
a
computer
computer
to
to
reverse
reverse
engineer
engineer
what
what
the
the
original
original
message
message
actually
actually
was.
was
These
these
are
are
really
really
useful
useful
characteristics
characteristics
because
because
it
it
allows
allows
developers
developers
to
to
store
store
data
data
without
without
needing
needing
to
to
know
know
its
its
true
true
value.
value
The
the
most
most
simple
simple
example
example
would
would
be
be
storing
storing
a
a
password
password
in
in
the
the
database,
database
you
you
wouldn't
wouldn't
wanna
wanna
store
store
the
the
real
real
password
password
because
because
if
if
a
a
hacker
hacker
gets
gets
a
a
hold
hold
of
of
that
that
database,
database
then
then
they
they
can
can
immediately
immediately
start
start
putting
putting
those
those
passwords
passwords
to
to
use.
use
But,
but
if
if
the
the
data
data
is
is
hashed,
hashed
then
then
they
they
have
have
to
to
also
also
crack
crack
that
that
hash
hash
to
to
figure
figure
out
out
what
what
the
the
true
true
password
password
is.
is
Let's
let's
go
go
ahead
ahead
and
and
implement
implement
a
a
hash
hash
in
in
Node.
node
Js.
js
You
you
can
can
follow
follow
along
along
with
with
the
the
source
source
code
code
on
on
FireShip
fireship
IO
io
or
or
GitHub,
github
and
and
all
all
you
you
need
need
to
to
get
get
started
started
is
is
a
a
JavaScript
javascript
file
file
with
with
Node.
node
Js
js
installed
installed
on
on
your
your
system.
system
The
the
first
first
thing
thing
we'll
we'll
do
do
is
is
import
import
the
the
create
create
hash
hash
function
function
from
from
nodecrypto,
nodecrypto
which
which
is
is
a
a
module
module
built
built
10
10
to
to
node
node
JS.
js
What
what
I'll
i'll
do
do
next
next
is
is
define
define
my
my
own
own
custom
custom
function
function
called
called
hash
hash
that
that
takes
takes
a
a
string
string
as
as
an
an
input
input
and
and
returns
returns
a
a
hash
hash
string
string
as
as
the
the
output.
output
The
the
first
first
step
step
is
is
to
to
define
define
the
the
hashing
hashing
algorithm
algorithm
that
that
you
you
want
want
to
to
use.
use
I'm
i'm
using
using
sha256
sha256
here,
here
which
which
stands
stands
for
for
secure
secure
hashing
hashing
algorithm,
algorithm
them,
them
and
and
returns
returns
a
a
hash
hash
value,
value
which
which
is
is
also
also
called
called
a
a
digest
digest
with
with
256
256
bits.
bits
The
the
algorithm
algorithm
you
you
choose
choose
here
here
is
is
important.
important
In
in
my
my
last
last
video,
video
I
i
carelessly
carelessly
used
used
MD
md
of
of
5
5
when
when
hashing
hashing
an
an
API
api
key.
key
And
and
you
you
guys
guys
were
were
quick
quick
to
to
call
call
me
me
out
out
on
on
it.
it
Fool
fool
this
this
man.
man
As
as
computers
computers
have
have
become
become
faster
faster
and
and
the
the
Internet
internet
more
more
vast,
vast
MD
md
5
5
has
has
become
become
obsolete.
obsolete
Remember,
remember
cryptography
cryptography
is
is
always
always
evolving.
evolving
SHA
sha
256
256
is
is
a
a
good
good
option,
option
but
but
there
there
are
are
even
even
better
better
solutions
solutions
like
like
Argon2,
argon2
although
although
it's
it's
not
not
built
built
into
into
node
node
crypto.
crypto
Once
once
we
we
have
have
our
our
hashing
hashing
function,
function
we
we
can
can
call
call
update
update
with
with
the
the
input
input
value
value
and
and
then
then
return
return
an
an
output
output
by
by
calling
calling
digest
digest
with
with
the
the
format
format
that
that
we
we
want
want
to
to
return.
return
In
in
this
this
video,
video
we'll
we'll
be
be
using
using
hexadecimal
hexadecimal
format,
format
but
but
another
another
option
option
you'll
you'll
commonly
commonly
see
see
is
is
base
base
60
60
4.
4
Now
now
that
that
we
we
have
have
this
this
function,
function
we
we
can
can
pass
pass
it
it
an
an
input
input
like
like
a
a
password
password
and
and
when
when
you
you
console
console
log
log
it,
it
you
you
get
get
this
this
long
long
string
string
of
of
numbers
numbers
and
and
letters
letters
that
that
hide
hide
its
its
original
original
meaning.
meaning
Now
now
if
if
we
we
create
create
another
another
hash
hash
and
and
compare
compare
the
the
2,
2
we'll
we'll
know
know
that
that
the
the
original
original
value
value
is
is
the
the
same
same
if
if
the
the
2
2
hashes
hashes
match
match
up.
up
That's
that's
super
super
useful,
useful
but
but
a
a
hash
hash
by
by
itself
itself
isn't
isn't
actually
actually
sufficient
sufficient
for
for
storing
storing
a
a
password
password
in
in
a
a
database,
database
and
and
that
that
brings
brings
us
us
to
to
our
our
next
next
topic,
topic
salt.
salt
The
the
fact
fact
that
that
a
a
hashing
hashing
function
function
always
always
returns
returns
the
the
same
same
value
value
is
is
also
also
a
a
problem
problem
when
when
it
it
comes
comes
to
to
passwords,
passwords
especially
especially
when
when
you
you
let
let
stupid
stupid
humans
humans
come
come
up
up
with
with
them,
them
like
like
password
password
123.
123
So
so
the
the
combination
combination
is
is
1,
1
2,
2
3,
3
4,
4
5.
5
That's
that's
the
the
stupidest
stupidest
combination
combination
I
i
ever
ever
heard
heard
in
in
my
my
life.
life
If
if
a
a
hacker
hacker
obtains
obtains
the
the
database
database
and
and
the
the
passwords
passwords
are
are
hashed,
hashed
they
they
can
can
often
often
just
just
go
go
to
to
something
something
like
like
a
a
rainbow
rainbow
table
table
that
that
has
has
a
a
bunch
bunch
of
of
pre
pre
computed
computed
hashes
hashes
and
and
find
find
a
a
bunch
bunch
of
of
commonly
commonly
used
used
passwords.
passwords
A
a
salt
salt
is
is
just
just
a
a
random
random
value
value
that's
that's
added
added
to
to
the
the
password
password
before
before
it's
it's
hashed,
hashed
therefore,
therefore
making
making
it
it
much
much
harder
harder
to
to
guess.
guess
In
in
Node,
node
we
we
can
can
hash
hash
a
a
password
password
with
with
salt
salt
by
by
importing
importing
sscript
sscript
and
and
the
the
random
random
bytes
bytes
function.
function
Then
then
we'll
we'll
define
define
functions,
functions
sign
sign
up
up
and
and
log
log
in,
in
that
that
take
take
an
an
email
email
and
and
password
password
as
as
their
their
arguments.
arguments
When
when
the
the
user
user
signs
signs
up,
up
we'll
we'll
generate
generate
a
a
salt,
salt
which
which
is
is
just
just
a
a
random
random
set
set
of
of
characters.
characters
Then
then
we'll
we'll
use
use
s
s
script
script
to
to
hash
hash
it.
it
We
we
provide
provide
it
it
with
with
the
the
original
original
password
password
and
and
salt
salt
and
and
provide
provide
a
a
key
key
length
length
which
which
is
is
recommended
recommended
to
to
be
be
of
of
xd4.
xd4
Without
without
going
going
into
into
details,
details
sscript
sscript
makes
makes
it
it
more
more
computationally
computationally
intensive
intensive
to
to
crack
crack
with
with
brute
brute
force,
force
and
and
it's
it's
actually
actually
been
been
used
used
as
as
a
a
proof
proof
of
of
work
work
algorithm
algorithm
used
used
in
in
cocurrency
cocurrency
mining.
mining
So
so
now
now
that
that
we
we
have
have
a
a
hash
hash
password,
password
we
we
also
also
need
need
to
to
store
store
the
the
salt
salt
with
with
it
it
in
in
the
the
database
database
and
and
we
we
can
can
do
do
that
that
by
by
just
just
prepending
prepending
it
it
to
to
the
the
existing
existing
being
being
separated
separated
by
by
a
a
semicolon.
semicolon
Now
now
when
when
the
the
user
user
goes
goes
to
to
log
log
in,
in
we
we
can
can
grab
grab
the
the
salt
salt
from
from
the
the
database
database
and
and
recreate
recreate
the
the
original
original
hash.
hash
Now
now
we
we
could
could
just
just
compare
compare
the
the
strings
strings
here,
here
but
but
as
as
one
one
added
added
touch,
touch
I'm
i'm
going
going
to
to
use
use
the
the
timing
timing
safe
safe
equal
equal
function
function
from
from
Nodecrypto,
nodecrypto
which
which
can
can
prevent
prevent
I
i
mean
mean
attacks,
attacks
where
where
a
a
hacker
hacker
measures
measures
the
the
amount
amount
of
of
time
time
it
it
takes
takes
to
to
perform
perform
an
an
operation
operation
to
to
obtain
obtain
information
information
about
about
the
the
value.
value
This
this
function
function
helps
helps
prevent
prevent
that
that
type
type
of
of
attack.
attack
It.
it
That's
that's
how
how
basic
basic
email
email
password
password
authentication
authentication
works
works
on
on
the
the
web,
web
but
but
a
a
related
related
topic
topic
you
you
might
might
come
come
across
across
is
is
hash
hash
based
based
message
message
authentication
authentication
code
code
or
or
HMAC.
hmac
The
the
quick
quick
definition
definition
is
is
that
that
it's
it's
a
a
hash
hash
that
that
also
also
requires
requires
a
a
password.
password
So
so
the
the
only
only
person
person
that
that
can
can
create
create
the
the
same
same
hash
hash
signature
signature
must
must
also
also
have
have
the
the
corresponding
corresponding
password
password
or
or
key.
key
You.
you
An
an
example
example
is
is
a
a
JSON
json
web
web
token
token
for
for
authentication
authentication
on
on
the
the
web.
web
When
when
a
a
user
user
logs
logs
in
in
on
on
a
a
trusted
trusted
server,
server
it
it
generates
generates
a
a
token
token
with
with
key,
key
then
then
the
the
client
client
and
and
server
server
can
can
pass
pass
it
it
back
back
and
and
forth,
forth
and
and
the
the
server
server
can
can
trust
trust
it
it
because
because
it
it
knows
knows
that
that
only
only
someone
someone
with
with
the
the
secret
secret
key
key
could
could
have
have
generated
generated
that
that
hash
hash
signature.
signature
Her.
her
In
in
Node,
node
we
we
can
can
import
import
the
the
create
create
hmac
hmac
function,
function
then
then
we'll
we'll
define
define
a
a
secret
secret
key
key
along
along
with
with
the
the
message
message
that
that
we
we
want
want
to
to
hash.
hash
We
we
can
can
create
create
a
a
hash
hash
just
just
like
like
we
we
did
did
in
in
first
first
example,
example
the
the
only
only
difference
difference
is
is
that
that
we
we
also
also
provide
provide
this
this
key.
key
The
the
important
important
thing
thing
to
to
notice
notice
here
here
is
is
that
that
we
we
get
get
the
the
same
same
hash
hash
when
when
the
the
same
same
password
password
is
is
used,
used
but
but
if
if
a
a
different
different
password
password
is
is
used,
used
we
we
get
get
an
an
entirely
entirely
different
different
hash.
hash
That's
that's
pretty
pretty
cool,
cool
but
but
what
what
happens
happens
when
when
you
you
want
want
to
to
share
share
a
a
secret
secret
with
with
someone,
someone
and
and
also
also
allow
allow
them
them
to
to
read
read
the
the
original
original
message?
message
That's
that's
where
where
encryption
encryption
comes
comes
in.
in
What
what
is
is
encryption
encryption
exactly?
exactly
With
with
encryption,
encryption
we
we
take
take
a
a
message,
message
scramble
scramble
up
up
the
the
bytes
bytes
to
to
make
make
it
it
unreadable,
unreadable
that's
that's
called
called
the
the
ciphertext,
ciphertext
then
then
provide
provide
a
a
key
key
or
or
password
password
allowing
allowing
somebody
somebody
else
else
to
to
decrypt
decrypt
it.
it
It's
it's
also
also
typically
typically
randomized,
randomized
so
so
that
that
each
each
time
time
you
you
encrypt,
encrypt
you
you
get
get
an
an
entirely
entirely
different
different
encrypted
encrypted
output
output
even
even
if
if
the
the
key
key
and
and
message
message
are
are
the
the
same.
same
The
the
first
first
encryption
encryption
example
example
we'll
we'll
look
look
at
at
is
is
symmetric,
symmetric
which
which
means
means
that
that
there's
there's
a
a
shared
shared
password
password
that
that
both
both
the
the
sender
sender
and
and
receiver
receiver
of
of
the
the
message
message
we'll
we'll
need.
need
To
to
implement
implement
it
it
in
in
node,
node
we're
we're
going
going
to
to
import
import
create
create
cipher
cipher
IV,
iv
IV
iv
stands
stands
for
for
initial
initial
vector
vector
by
by
the
the
way,
way
along
along
with
with
random
random
bytes
bytes
and
and
create
create
decipher.
decipher
First,
first
we
we
have
have
the
the
message
message
itself.
itself
That's
that's
what
what
we're
we're
trying
trying
to
to
encrypt.
encrypt
Then
then
we'll
we'll
define
define
the
the
key
key
as
as
32
32
random
random
bytes,
bytes
and
and
also
also
the
the
initial
initial
vector
vector
as
as
16
16
random
random
bytes.
bytes
This
this
will
will
randomize
randomize
the
the
output
output
when
when
it's
it's
encrypted,
encrypted
so
so
an
an
identical
identical
sequence
sequence
of
of
text
text
will
will
never
never
produce
produce
the
the
exact
exact
same
same
ciphertext,
ciphertext
making
making
it
it
more
more
difficult
difficult
for
for
a
a
hacker
hacker
to
to
break
break
the
the
encryption.
encryption
Now,
now
we
we
can
can
use
use
these
these
values
values
to
to
create
create
a
a
cipher.
cipher
Like
like
a
a
hash,
hash
it's
it's
dependent
dependent
upon
upon
an
an
algorithm,
algorithm
although
although
encryption
encryption
algorithms
algorithms
are
are
inherently
inherently
different
different
than
than
hashing
hashing
algorithms.
algorithms
So
so
you'll
you'll
notice
notice
an
an
entirely
entirely
different
different
set
set
of
of
options
options
here.
here
Now,
now
you
you
can
can
use
use
the
the
Cypher
cypher
to
to
encrypt
encrypt
a
a
message
message
by
by
calling
calling
update
update
or
or
even
even
multiple
multiple
messages
messages
if
if
you
you
want
want
to,
to
then
then
finish
finish
it
it
off
off
by
by
calling
calling
cypher
cypher
final
final
and
and
add
add
that
that
value
value
to
to
the
the
end
end
of
of
the
the
encrypted
encrypted
message.
message
At
at
this
this
point,
point
the
the
cipher
cipher
can
can
no
no
longer
longer
be
be
used
used
to
to
encrypt
encrypt
data.
data
Now,
now
to
to
decipher
decipher
it,
it
create
create
a
a
decipher
decipher
object
object
with
with
the
the
same
same
key
key
and
and
initial
initial
vector.
vector
Use
use
the
the
same
same
basic
basic
pattern
pattern
with
with
update
update
and
and
final
final
to
to
convert
convert
the
the
encrypted
encrypted
message
message
back
back
into
into
plain
plain
text,
text
and
and
that's
that's
how
how
you
you
encrypt
encrypt
and
and
decrypt
decrypt
a
a
message
message
and
and
note.
note
The
the
world
world
isn't
isn't
run
run
by
by
weapons
weapons
anymore
anymore
or
or
energy
energy
or
or
money.
money
It's
it's
run
run
by
by
little
little
ones
ones
and
and
zeros,
zeros
little
little
bits
bits
of
of
data.
data
It's
it's
all
all
just
just
electrons.
electrons
However,
however
there
there
is
is
one
one
big
big
limitation
limitation
with
with
symmetric
symmetric
encryption,
encryption
and
and
that's
that's
the
the
fact
fact
that
that
both
both
the
the
sender
sender
and
and
receiver
receiver
of
of
the
the
message
message
need
need
to
to
share
share
a
a
password.
password
It's
it's
just
just
not
not
very
very
practical
practical
for
for
2
2
different
different
parties
parties
to
to
agree
agree
upon
upon
a
a
shared
shared
password.
password
Once
once
again,
again
math
math
comes
comes
to
to
the
the
rescue,
rescue
this
this
time
time
in
in
the
the
form
form
of
of
a
a
public
public
key
key
cryptosystem.
cryptosystem
Instead
instead
of
of
one
one
key,
key
it
it
uses
uses
2
2
keys
keys
that
that
are
are
mathematically
mathematically
linked,
linked
a
a
public
public
key
key
and
and
a
a
private
private
a
a
key.
key
As
as
the
the
name
name
suggests,
suggests
the
the
private
private
key
key
should
should
always
always
be
be
kept
kept
secret
secret
while
while
the
the
public
public
key
key
can
can
be
be
shared
shared
with
with
other
other
people.
people
Think
think
of
of
it
it
like
like
a
a
mailbox.
mailbox
You
you
have
have
a
a
slot
slot
where
where
anybody
anybody
can
can
add
add
mail
mail
into
into
the
the
box,
box
that's
that's
your
your
public
public
key,
key
but
but
to
to
get
get
the
the
mail
mail
out,
out
you
you
need
need
the
the
private
private
key,
key
which
which
can
can
only
only
be
be
done
done
by
by
the
the
owner
owner
of
of
the
the
key.
key
In
in
Node,
node
we
we
can
can
generate
generate
a
a
private
private
and
and
public
public
key
key
pair
pair
using
using
the
the
generate
generate
key
key
pair
pair
function.
function
The
the
first
first
argument
argument
is
is
the
the
cryptosystem
cryptosystem
you
you
wanna
wanna
use,
use
which
which
in
in
our
our
case
case
will
will
be
be
RSA.
rsa
That's
that's
the
the
most
most
common
common
one
one
that
that
you'll
you'll
come
come
across.
across
From
from
there,
there
you
you
can
can
define
define
a
a
bunch
bunch
of
of
settings,
settings
like,
like
the
the
length
length
of
of
the
the
key
key
and
and
bits
bits
and
and
also
also
the
the
encoding
encoding
for
for
the
the
public
public
and
and
private
private
key.
key
We'll
we'll
go
go
with
with
the
the
recommended
recommended
settings
settings
here
here
and
and
have
have
it
it
return
return
a
a
format
format
of
of
PEM
pem
to
to
show
show
us
us
the
the
keys
keys
in
in
base
base
64
64
format.
format
You
you
can
can
also
also
add
add
a
a
passphrase
passphrase
to
to
your
your
private
private
key
key
for
for
added
added
security.
security
If
if
we
we
go
go
ahead
ahead
and
and
console
console
log,
log
we
we
get
get
values
values
for
for
the
the
public
public
and
and
private
private
keys.
keys
Then
then
I'll
i'll
export
export
them
them
from
from
this
this
file
file
to
to
put
put
them
them
to
to
use.
use
And
and
that
that
brings
brings
us
us
to
to
asymmetric
asymmetric
encryption.
encryption
You
you
use
use
asymmetric
asymmetric
encryption,
encryption
anytime
anytime
you
you
go
go
to
to
a
a
website
website
using
using
HTTPS,
https
the
the
browser
browser
will
will
automatically
automatically
find
find
a
a
public
public
key
key
of
of
an
an
SSL
ssl
certificate
certificate
installed
installed
on
on
the
the
sight.
sight
That
that
public
public
key
key
is
is
used
used
to
to
encrypt
encrypt
any
any
data
data
that
that
you
you
send
send
to
to
the
the
website.
website
That
that
prevents
prevents
hackers
hackers
from
from
gaining
gaining
anything
anything
useful
useful
from
from
it
it
in
in
transit.
transit
Your
your
where
where
data
data
is
is
then
then
decrypted
decrypted
with
with
the
the
private
private
key
key
by
by
the
the
trusted
trusted
website.
website
The
the
implementation
implementation
in
in
Node
node
is
is
very
very
simple.
simple
We
we
import
import
public
public
encrypt
encrypt
and
and
private
private
decrypt
decrypt
from
from
NodeCrypto
nodecrypto
along
along
with
with
the
the
public
public
key
key
and
and
private
private
key
key
that
that
we
we
generated
generated
previously.
previously
We
we
can
can
then
then
encrypt
encrypt
a
a
message
message
or
or
put
put
it
it
in
in
the
the
mailbox
mailbox
by
by
combining
combining
the
the
public
public
key
key
with
with
the
the
message
message
itself.
itself
In
in
this
this
case,
case
it
it
needs
needs
to
to
be
be
in
in
a
a
buffer
buffer
format.
format
That
that
will
will
encrypt
encrypt
it
it
so
so
that
that
only
only
the
the
owner
owner
of
of
the
the
mailbox
mailbox
can
can
read
read
it.
it
At
at
some
some
point
point
in
in
the
the
future,
future
the
the
recipient
recipient
may
may
want
want
to
to
read
read
the
the
original
original
message,
message
which
which
can
can
be
be
done
done
by
by
calling
calling
private
private
decrypt
decrypt
with
with
the
the
private
private
key
key
and
and
the
the
encrypted
encrypted
data.
data
Encryption
encryption
is
is
fun,
fun
but
but
in
in
many
many
cases,
cases
you
you
don't
don't
actually
actually
need
need
to
to
encrypt
encrypt
data,
data
but
but
rather
rather
validate
validate
that
that
it
it
came
came
from
from
a
a
trusted
trusted
party.
party
That's
that's
where
where
signing
signing
comes
comes
in.
in
What
what
is
is
a
a
digital
digital
signature?
signature
Let's
let's
imagine
imagine
you're
you're
expecting
expecting
a
a
letter
letter
in
in
the
the
mail
mail
with
with
some
some
sensitive
sensitive
information,
information
you
you
need
need
to
to
be
be
able
able
to
to
trust
trust
that
that
that
that
letter
letter
came
came
from
from
the
the
right
right
person,
person
so
so
you
you
require
require
them
them
to
to
sign
sign
it
it
in
in
blood.
blood
It
it
also
also
can't
can't
be
be
tampered
tampered
with,
with
so
so
they
they
put
put
a
a
special
special
seal
seal
on
on
it
it
that
that
if
if
broken
broken
will
will
indicate
indicate
that
that
it's
it's
been
been
tampered
tampered
with.
with
Digital
digital
signatures
signatures
work
work
in
in
the
the
same
same
basic
basic
way.
way
The
the
sender
sender
of
of
the
the
message,
message
we'll
we'll
use
use
their
their
private
private
key
key
to
to
sign
sign
a
a
hash
hash
of
of
the
the
original
original
message.
message
The
the
private
private
key
key
guarantees
guarantees
authenticity,
authenticity
like
like
blood,
blood
and
and
the
the
hash
hash
guarantees
guarantees
that
that
the
the
message
message
can't
can't
be
be
tampered
tampered
with
with
because
because
it
it
would
would
produce
produce
an
an
entirely
entirely
different
different
signature.
signature
The
the
recipient
recipient
can
can
then
then
use
use
the
the
public
public
key
key
to
to
validate
validate
the
the
authenticity
authenticity
of
of
the
the
message.
message
In
in
Node,
node
we
we
can
can
create
create
a
a
signature
signature
with
with
the
the
create
create
sign
sign
function,
function
then
then
pass
pass
it
it
an
an
algorithm
algorithm
that
that
uses
uses
the
the
RSA
rsa
cryptosystem
cryptosystem
with
with
sha
sha
256
256
X4
x4
hashing.
hashing
We
we
then
then
update
update
it
it
with
with
the
the
message
message
that
that
we
we
want
want
to
to
sign
sign
and
and
create
create
the
the
actual
actual
signature
signature
with
with
the
the
private
private
key.
key
We
we
can
can
now
now
attach
attach
the
the
signature
signature
to
to
the
the
original
original
message
message
and
and
send
send
it
it
to
to
someone.
someone
When
when
they
they
get
get
it,
it
they
they
can
can
create
create
a
a
verifier,
verifier
update
update
the
the
original
original
message,
message
and
and
then
then
verify
verify
the
the
signature
signature
with
with
the
the
sender's
sender's
public
public
key.
key
If
if
the
the
signature
signature
was
was
forged
forged
or
or
the
the
message
message
changed,
changed
the
the
verifier
verifier
will
will
fail.
fail
And
and
that
that
gives
gives
us
us
7
7
different
different
cryptography
cryptography
concepts
concepts
that
that
I
i
think
think
every
every
developer
developer
should
should
know.
know
The
the
final
final
thing
thing
I'll
i'll
leave
leave
you
you
with
with
is
is
a
a
challenge.
challenge
In
in
the
the
GitHub
github
repo,
repo
there's
there's
a
a
file
file
called
called
hack
hack
dotjs.
dotjs
Inside
inside
it
it
is
is
a
a
hash.
hash
Use
use
your
your
hacking
hacking
skills
skills
to
to
crack
crack
it
it
and
and
put
put
the
the
answer
answer
below.
below
1st
1st
one
one
to
to
submit
submit
a
a
pull
pull
request
request
wins
wins
a
a
free
free
Lifetime
lifetime
Pro
pro
membership
membership
and
and
t
t
shirt.
shirt
If
if
this
this
video
video
helped
helped
you,
you
hit
hit
the
the
like
like
button
button
and
and
subscribe.
subscribe
Thanks
thanks
for
for
watching
watching
and
and
I
i
will
will
see
see
you
you
in
in
the
the
next
next
one.
one
success
The speakers discuss the importance of understanding key concepts in cryptography, including hashing, encryption, and signing. They emphasize the need for a shared password to ensure privacy and security, and provide video resources on creating digital signatures and a new challenge for a job. The speakers also note the evolving use of cryptography and its limitations, including the use of hashing and random characters.
7 Cryptography Concepts EVERY Developer Should Know
Cryptography is terrifying. It's based on math that most of us don't understand, yet is the one thing that makes the Internet secure. Without the mysterious art of cryptography, there would be no secrets and no privacy in the digital world. Your emails, bank records, and browsing history would be easily hackable. Computers, by design, do exactly what we tell them to do. But sometimes, we don't want them to do certain things, like expose private data. I'm sorry, Dave. I'm afraid I can't do that, cryptography can take some useful bytes of data, then scramble them up with an algorithm, making it nearly impossible for a computer to understand its true meaning without the proper credentials. In today's video, we'll look at 7 useful crypto concepts that every developer should know and the best way to learn this stuff is to get Xon. So we'll implement each concept in Node. Js with its built in crypto module. And make sure to stay tuned until the end because there's a challenge and the first person to solve it it's a free lifetime pro membership and t shirt. Cryptography is the science of creating secrets, and has been around long before the computer. It. Before humans got good at math, they would tattoo secrets on the shaved head of a slave, then let their hair grow out to obfuscate it. But there are some obvious vulnerabilities with this pattern. An attacker could simply shave the head to access the message. Things got much better by the time of Julius Caesar, who shifted the letters of the alphabet before passing messages to his military generals, creating what's known as the Caesar cipher. Now, fast forward to 2025 and all the algorithms you're using today are made obsolete by super mega quantum computers that can crack them with brute force. The point I'm making is that cryptography is always evolving. What is considered safe and secure today may not be the case tomorrow. Pro. Luckily, as a developer, you don't need to understand all the complex math that goes into cryptography, but it is absolutely essential to understand how certain key concepts work, like, hashing, encryption, and signing, just to name a few. The first concept we'll look at is the hash. What is a hash? The name sounds kind of intimidating to me, but the word itself actually has culinary roots meaning to chop and mix, and that perfectly describes what a hashing function does. You start with an input, which can be any length, then pass it off to a hashing function. This function returns a fixed length value of what looks like just meaningless garbage. The important thing here is that the function will always produce the same output given the same input. It needs to be fast to compute and unique. However, it's extremely difficult for a computer to reverse engineer what the original message actually was. These are really useful characteristics because it allows developers to store data without needing to know its true value. The most simple example would be storing a password in the database, you wouldn't wanna store the real password because if a hacker gets a hold of that database, then they can immediately start putting those passwords to use. But, if the data is hashed, then they have to also crack that hash to figure out what the true password is. Let's go ahead and implement a hash in Node. Js. You can follow along with the source code on FireShip IO or GitHub, and all you need to get started is a JavaScript file with Node. Js installed on your system. The first thing we'll do is import the create hash function from nodecrypto, which is a module built 10 to node JS. What I'll do next is define my own custom function called hash that takes a string as an input and returns a hash string as the output. The first step is to define the hashing algorithm that you want to use. I'm using sha256 here, which stands for secure hashing algorithm, them, and returns a hash value, which is also called a digest with 256 bits. The algorithm you choose here is important. In my last video, I carelessly used MD of 5 when hashing an API key. And you guys were quick to call me out on it. Fool this man. As computers have become faster and the Internet more vast, MD 5 has become obsolete. Remember, cryptography is always evolving. SHA 256 is a good option, but there are even better solutions like Argon2, although it's not built into node crypto. Once we have our hashing function, we can call update with the input value and then return an output by calling digest with the format that we want to return. In this video, we'll be using hexadecimal format, but another option you'll commonly see is base 60 4. Now that we have this function, we can pass it an input like a password and when you console log it, you get this long string of numbers and letters that hide its original meaning. Now if we create another hash and compare the 2, we'll know that the original value is the same if the 2 hashes match up. That's super useful, but a hash by itself isn't actually sufficient for storing a password in a database, and that brings us to our next topic, salt. The fact that a hashing function always returns the same value is also a problem when it comes to passwords, especially when you let stupid humans come up with them, like password 123. So the combination is 1, 2, 3, 4, 5. That's the stupidest combination I ever heard in my life. If a hacker obtains the database and the passwords are hashed, they can often just go to something like a rainbow table that has a bunch of pre computed hashes and find a bunch of commonly used passwords. A salt is just a random value that's added to the password before it's hashed, therefore, making it much harder to guess. In Node, we can hash a password with salt by importing sscript and the random bytes function. Then we'll define functions, sign up and log in, that take an email and password as their arguments. When the user signs up, we'll generate a salt, which is just a random set of characters. Then we'll use s script to hash it. We provide it with the original password and salt and provide a key length which is recommended to be of xd4. Without going into details, sscript makes it more computationally intensive to crack with brute force, and it's actually been used as a proof of work algorithm used in cocurrency mining. So now that we have a hash password, we also need to store the salt with it in the database and we can do that by just prepending it to the existing being separated by a semicolon. Now when the user goes to log in, we can grab the salt from the database and recreate the original hash. Now we could just compare the strings here, but as one added touch, I'm going to use the timing safe equal function from Nodecrypto, which can prevent I mean attacks, where a hacker measures the amount of time it takes to perform an operation to obtain information about the value. This function helps prevent that type of attack. It. That's how basic email password authentication works on the web, but a related topic you might come across is hash based message authentication code or HMAC. The quick definition is that it's a hash that also requires a password. So the only person that can create the same hash signature must also have the corresponding password or key. You. An example is a JSON web token for authentication on the web. When a user logs in on a trusted server, it generates a token with key, then the client and server can pass it back and forth, and the server can trust it because it knows that only someone with the secret key could have generated that hash signature. Her. In Node, we can import the create hmac function, then we'll define a secret key along with the message that we want to hash. We can create a hash just like we did in first example, the only difference is that we also provide this key. The important thing to notice here is that we get the same hash when the same password is used, but if a different password is used, we get an entirely different hash. That's pretty cool, but what happens when you want to share a secret with someone, and also allow them to read the original message? That's where encryption comes in. What is encryption exactly? With encryption, we take a message, scramble up the bytes to make it unreadable, that's called the ciphertext, then provide a key or password allowing somebody else to decrypt it. It's also typically randomized, so that each time you encrypt, you get an entirely different encrypted output even if the key and message are the same. The first encryption example we'll look at is symmetric, which means that there's a shared password that both the sender and receiver of the message we'll need. To implement it in node, we're going to import create cipher IV, IV stands for initial vector by the way, along with random bytes and create decipher. First, we have the message itself. That's what we're trying to encrypt. Then we'll define the key as 32 random bytes, and also the initial vector as 16 random bytes. This will randomize the output when it's encrypted, so an identical sequence of text will never produce the exact same ciphertext, making it more difficult for a hacker to break the encryption. Now, we can use these values to create a cipher. Like a hash, it's dependent upon an algorithm, although encryption algorithms are inherently different than hashing algorithms. So you'll notice an entirely different set of options here. Now, you can use the Cypher to encrypt a message by calling update or even multiple messages if you want to, then finish it off by calling cypher final and add that value to the end of the encrypted message. At this point, the cipher can no longer be used to encrypt data. Now, to decipher it, create a decipher object with the same key and initial vector. Use the same basic pattern with update and final to convert the encrypted message back into plain text, and that's how you encrypt and decrypt a message and note. The world isn't run by weapons anymore or energy or money. It's run by little ones and zeros, little bits of data. It's all just electrons. However, there is one big limitation with symmetric encryption, and that's the fact that both the sender and receiver of the message need to share a password. It's just not very practical for 2 different parties to agree upon a shared password. Once again, math comes to the rescue, this time in the form of a public key cryptosystem. Instead of one key, it uses 2 keys that are mathematically linked, a public key and a private a key. As the name suggests, the private key should always be kept secret while the public key can be shared with other people. Think of it like a mailbox. You have a slot where anybody can add mail into the box, that's your public key, but to get the mail out, you need the private key, which can only be done by the owner of the key. In Node, we can generate a private and public key pair using the generate key pair function. The first argument is the cryptosystem you wanna use, which in our case will be RSA. That's the most common one that you'll come across. From there, you can define a bunch of settings, like, the length of the key and bits and also the encoding for the public and private key. We'll go with the recommended settings here and have it return a format of PEM to show us the keys in base 64 format. You can also add a passphrase to your private key for added security. If we go ahead and console log, we get values for the public and private keys. Then I'll export them from this file to put them to use. And that brings us to asymmetric encryption. You use asymmetric encryption, anytime you go to a website using HTTPS, the browser will automatically find a public key of an SSL certificate installed on the sight. That public key is used to encrypt any data that you send to the website. That prevents hackers from gaining anything useful from it in transit. Your where data is then decrypted with the private key by the trusted website. The implementation in Node is very simple. We import public encrypt and private decrypt from NodeCrypto along with the public key and private key that we generated previously. We can then encrypt a message or put it in the mailbox by combining the public key with the message itself. In this case, it needs to be in a buffer format. That will encrypt it so that only the owner of the mailbox can read it. At some point in the future, the recipient may want to read the original message, which can be done by calling private decrypt with the private key and the encrypted data. Encryption is fun, but in many cases, you don't actually need to encrypt data, but rather validate that it came from a trusted party. That's where signing comes in. What is a digital signature? Let's imagine you're expecting a letter in the mail with some sensitive information, you need to be able to trust that that letter came from the right person, so you require them to sign it in blood. It also can't be tampered with, so they put a special seal on it that if broken will indicate that it's been tampered with. Digital signatures work in the same basic way. The sender of the message, we'll use their private key to sign a hash of the original message. The private key guarantees authenticity, like blood, and the hash guarantees that the message can't be tampered with because it would produce an entirely different signature. The recipient can then use the public key to validate the authenticity of the message. In Node, we can create a signature with the create sign function, then pass it an algorithm that uses the RSA cryptosystem with sha 256 X4 hashing. We then update it with the message that we want to sign and create the actual signature with the private key. We can now attach the signature to the original message and send it to someone. When they get it, they can create a verifier, update the original message, and then verify the signature with the sender's public key. If the signature was forged or the message changed, the verifier will fail. And that gives us 7 different cryptography concepts that I think every developer should know. The final thing I'll leave you with is a challenge. In the GitHub repo, there's a file called hack dotjs. Inside it is a hash. Use your hacking skills to crack it and put the answer below. 1st one to submit a pull request wins a free Lifetime Pro membership and t shirt. If this video helped you, hit the like button and subscribe. Thanks for watching and I will see you in the next one.
The speakers discuss the importance of understanding key concepts in cryptography, including hashing, encryption, and signing. They emphasize the need for a shared password to ensure privacy and security, and provide video resources on creating digital signatures and a new challenge for a job. The speakers also note the evolving use of cryptography and its limitations, including the use of hashing and random characters.