Hi folks, I’m attempting to port this JS code into its Erlang/Elixir equivalent: const key = "mysecretkey"; function decryptString(encryptedString) { const algorithm = 'aes256'; const decipher = crypto.createDecipher(algorithm, key); return decipher.update(encryptedString, 'hex', 'utf…

I like crypto! And I like puzzles, and I had a suspicion Node was doing something silly, so I chased this a bit. I’ll say two things right off the bat: First, this would be confusing to anyone. Node made some choices that favored ease of use, and sacrificed clarity (and security!) in the process. N…

AES256 require key to be exactly 32 byte long, your key is 11 bytes, 21 bytes too short. JS code probably does some padding to achieve what you want. However: For gods sake, do not use this code. Burry it in the dessert, and wear gloves. After that burn all your clothes. Jokes aside - this is ter…

Thanks for the suggestion and for the wisdom re the code. Yes I’m aware it’s flawed (actually I’m porting it in order to eventually remove it).

Not sure what you’re specific encryption needs are, but if you’re going to implement encryption in Elixir then you might want to consider using the enacl library. If you have simpler needs depending on your use case, i.e. transparent database field encryption with Ecto (symmetric), then you can loo…

I got a bit closer by trimming the key to the suggested length, thank you. Unfortunately I’m clearly doing something else wrong too because the returned value is quite clearly not cleartext ;). Any further hints on where to look? As you can probably already tell I’m fairly lacking in knowledge in…

This has to be answer of the year!!! Awesome work.

[image] mattbaker: Summarizing Aren’t you supposed to be on vacation?

What an incredible answer. Thanks so much for helping and teaching me a thing or two along the way.

[image] mattbaker: Something like aes_256_cbc is fine as far as I know Please, do not do that. Encryption without authentication is pointless as attacker can manipulate the plaintext without any problems (without knowing the plaintext): iex> key = :crypto.strong_rand_bytes(32) iex> <<a, rest…

The more I learn crypto, the more there is to learn :frowning: I know it is true for most domains but in that case it is almost overwhelming.

That is why if you have these thee letters anywhere in your code AES then you are probably vulnerable. If you want to do it right you have few options: If there is no additional requirements - encrypt only on transport layer, like TLS, and call it a day Use good token implementations, like PASETO …

Elixir Programming Language Forum

Porting node.js encryption function to Elixir

Questions & Help Questions

emeryotopalik May 20, 2021, 1:21am 8

Aren’t you supposed to be on vacation?