Node.js v6.2.2 crypto.createCipheriv "Longueur de clé invalide" Erreur

Question

Ci-dessous la source de multipassify.

Le code fonctionne parfaitement en dessous du nœud 6 et renvoie une erreur.

L'erreur ressemble à ceci:

crypto.js:184 
    this._handle.initiv(cipher, toBuf(key), toBuf(iv)); 
      ^

Error: Invalid key length 
    at Error (native) 
    at new Cipheriv (crypto.js:184:16) 
    at Object.Cipheriv (crypto.js:182:12) 
    at multipassify.encrypt (/Users/thomasreggi/Desktop/super-octopus/node_modules/multipassify/multipassify.js:52:25) 
    at multipassify.encode (/Users/thomasreggi/Desktop/super-octopus/node_modules/multipassify/multipassify.js:28:27) 
    at Object.<anonymous> (/Users/thomasreggi/Desktop/super-octopus/multi.js:8:26) 
    at Module._compile (module.js:541:32) 
    at Object.Module._extensions..js (module.js:550:10) 
    at Module.load (module.js:458:32) 
    at tryModuleLoad (module.js:417:12) 

est ici la source.

var crypto = require('crypto'); 

var BLOCK_SIZE = 16; 

var multipassify = module.exports = function(secret) { 
    if (!(this instanceof multipassify)) return new multipassify(secret); 
    if (!(typeof secret == 'string' && secret.length > 0)) throw new Error('Invalid Secret'); 

    // Use the Multipass secret to derive two cryptographic keys, 
    // one for encryption, one for signing 
    var hash = crypto.createHash("sha256").update(secret).digest('binary'); 
    this._encryptionKey = hash.substring(0, BLOCK_SIZE); 
    this._signingKey = hash.substring(BLOCK_SIZE, 32); 
    return this; 
}; 

multipassify.prototype.encode = function(obj) { 
    if (!obj) return; 

    // Store the current time in ISO8601 format. 
    // The token will only be valid for a small timeframe around this timestamp. 
    obj["created_at"] = new Date().toISOString(); 

    // Serialize the customer data to JSON and encrypt it 
    var cipherText = this.encrypt(JSON.stringify(obj)); 

    // Create a signature (message authentication code) of the ciphertext 
    // and encode everything using URL-safe Base64 (RFC 4648) 
    var token = new Buffer(cipherText + this.sign(cipherText),'binary').toString('base64'); 
    token = token.replace(/\+/g, '-') // Replace + with - 
     .replace(/\//g, '_'); // Replace/with _ 

    return token; 
}; 

multipassify.prototype.generateUrl = function(obj, domain) { 
    if(!domain) return; 
    return "https://" + domain + "/account/login/multipass/" + this.encode(obj); 
}; 

multipassify.prototype.sign = function (data) { 
    var signed = crypto.createHmac("SHA256", this._signingKey).update(data).digest('binary'); 
    return signed; 
} 

multipassify.prototype.encrypt = function(plaintext) { 
    // Use a random IV 
    var iv = crypto.randomBytes(BLOCK_SIZE); 
    var cipher = crypto.createCipheriv('aes-128-cbc', this._encryptionKey,iv); 

    // Use IV as first block of ciphertext 
    var encrypted = iv.toString('binary') + cipher.update(plaintext, 'utf8', 'binary') + cipher.final('binary'); 
    return encrypted; 
} 

J'ai essayé de déconner avec la conversion du hachage et this._encryptionKey en binaire. En utilisant ce github issue comme un guide, mais je n'ai pas de chance d'essayer de travailler avec le nœud 6. Quelqu'un sait-il un moyen facile de le faire fonctionner avec des versions ultérieures du nœud?

Answer 1

Entré en travers du repère dans une fourche du repo.

https://github.com/achinn/multipassify/blob/176c7664c8458cdfb8f20fac97fe27b7b7d1bff4/multipassify.js

Toutes les déclarations « binaires » sont supprimés parce que je crois qu'il est la valeur par défaut, donc pas de sens dans les deux sens de commutation. J'ai également remarqué que Buffer.concat([value, value]) est utilisé sur new Buffer(value + value).

var crypto = require('crypto'); 

var BLOCK_SIZE = 16; 

var multipassify = module.exports = function(secret) { 
    if (!(this instanceof multipassify)) return new multipassify(secret); 
    if (!(typeof secret == 'string' && secret.length > 0)) throw new Error('Invalid Secret'); 

    // Use the Multipass secret to derive two cryptographic keys, 
    // one for encryption, one for signing 
    var hash = crypto.createHash("sha256").update(secret).digest(); 
    this._encryptionKey = hash.slice(0, BLOCK_SIZE); 
    this._signingKey = hash.slice(BLOCK_SIZE, 32); 
    return this; 
}; 

multipassify.prototype.encode = function(obj) { 
    if (!obj) return; 

    // Store the current time in ISO8601 format. 
    // The token will only be valid for a small timeframe around this timestamp. 
    obj["created_at"] = new Date().toISOString(); 

    // Serialize the customer data to JSON and encrypt it 
    var cipherText = this.encrypt(JSON.stringify(obj)); 

    // Create a signature (message authentication code) of the ciphertext 
    // and encode everything using URL-safe Base64 (RFC 4648) 
    var token = Buffer.concat([cipherText, this.sign(cipherText)]).toString('base64'); 
    token = token.replace(/\+/g, '-') // Replace + with - 
     .replace(/\//g, '_'); // Replace/with _ 

    return token; 
}; 

multipassify.prototype.generateUrl = function(obj, domain) { 
    if(!domain) return; 
    return "https://" + domain + "/account/login/multipass/" + this.encode(obj); 
}; 

multipassify.prototype.sign = function (data) { 
    var signed = crypto.createHmac("SHA256", this._signingKey).update(data).digest(); 
    return signed; 
} 

multipassify.prototype.encrypt = function(plaintext) { 
    // Use a random IV 
    var iv = crypto.randomBytes(BLOCK_SIZE); 
    var cipher = crypto.createCipheriv('aes-128-cbc', this._encryptionKey,iv); 

    // Use IV as first block of ciphertext 
    var encrypted = Buffer.concat([iv, cipher.update(plaintext, 'utf8'), cipher.final()]); 
    return encrypted; 
}