title: NodeJS "crypto" hash seems to produce different output than Crypto-JS javascript library
body: <p>I am using NodeJS's bundled <a href="http://nodejs.org/api/crypto.html#crypto_class_hash" rel="nofollow"><code>crypto</code></a> module for SHA256 hashing on the server-side.
  On the client-side, I am using a javascript library called <a href="http://code.google.com/p/crypto-js/#SHA-2" rel="nofollow"><code>Crypto-JS</code></a>.</p>
  
  <p>I am using SHA256 hashes for a login system that uses classical nonce-based authentication. However, my server-side and client-side hash-digests don't match up even when the hash-messages are the same (I have checked this). Even the length of the hash-digests are different.</p>
  
  <p>This is a snippet of my client-side implementation:</p>
  
  <pre><code>var password_hash = CryptoJS.SHA256( token.nonce /*this is the server's nonce*/ + cnonce + password ).toString(CryptoJS.enc.Base64);
  </code></pre>
  
  <p>This is a snippet of my server-side implementation:</p>
  
  <pre><code>var sha256 = CRYPTO.createHash("sha256");
  sha256.update(snonce+cnonce+password, "utf-8");
  var hash = sha256.digest("base64");
  </code></pre>
  
  <p>This is some sample data:</p>
  
  <pre><code>client-digest: d30ab96e65d09543d7b97d7cad6b6cf65f852f5dd62c256595a7540c3597eec4
  server-digest: vZaCi0mCDufqFUwVO40CtKIW7GS4h+XUhTUWxVhu0HQ=
  
  client-message: O1xxQAi2Y7RVHCgXoX8+AmWlftjSfsrA/yFxMaGCi38ZPWbUZBhkVDc5eadCHszzbcOdgdEZ6be+AZBsWst+Zw==b3f23812448e7e8876e35a291d633861713321fe15b18c71f0d54abb899005c9princeofnigeria
  server-message: O1xxQAi2Y7RVHCgXoX8+AmWlftjSfsrA/yFxMaGCi38ZPWbUZBhkVDc5eadCHszzbcOdgdEZ6be+AZBsWst+Zw==b3f23812448e7e8876e35a291d633861713321fe15b18c71f0d54abb899005c9princeofnigeria 
  </code></pre>
  
  <p>Does anyone know why the hashes are different? I thought that if it is the same protocol/algorithm, it will always produce the same hash.</p>
  
  <p>Edit: Wow. I went to this <a href="http://www.xorbin.com/tools/sha256-hash-calculator" rel="nofollow">online hashing tool</a> and it produces yet another digest for the same message:</p>
  
  <pre><code>4509a6d5028b217585adf41e7d49f0e7c1629c59c29ce98ef7fbb96c6f27502c
  </code></pre>
  
  <p>Edit Edit: On second thought, the reason for the online hashing tool being different is probably because it uses a <code>hex</code> encoding and I used <code>base64</code></p>