crypto module

crypto.createHash(algorithm)

var crypto = require('crypto');
session.input.readAsBuffer(function(error, data) {
  if (error) {
    console.error("readAsBuffer error "+error);
  } else {
    var hash = crypto.createHash('sha256');
    var result = hash.update(data).digest('base64');
    session.output.write(result);
  }
});

hash.digest([output_encoding])

The encoding must be 'hex' or 'base64'. If no encoding is provided, then a Buffer is returned. The hash object cannot be used after the digest() method is called.

hash.update(data[, input_encoding])

The input_encoding must be 'utf8' or 'ascii'. If no encoding is provided and the input is a string, an encoding of 'utf8' is enforced. If data is a Buffer or Buffers, then input encoding is ignored.

crypto.createHmac(algorithm, key)

For more information about formats when defining a key object, see Key object usage.

var crypto = require('crypto');
var key = "Alice";

var hmac = crypto.createHmac('hmac-sha256', key);
var input = "This is plaintext to hash";
var result = hmac.update(input).digest('base64');

session.output.write(result);

hmac.digest([output_encoding])

The encoding can be 'hex' or 'base64'. If no encoding is provided, then a Buffer is returned. The hmac object cannot be used after the digest() method is called.

hmac.update(data[, input_encoding])

The input_encoding can be 'utf8' or 'ascii'. If no encoding is provided and the input is a string, an encoding of 'utf8' is enforced. If data is a Buffer or Buffers, then input encoding is ignored.

cipher.final([encoding])

The encoding must be 'base64' or 'hex'. If no encoding is provided, then a Buffer is returned. The cipher object cannot be used after the final() method is called.

cipher.getAuthTag()

Used for authenticated encryption modes. The encryption mode must be Encrypt-then-MAC. It is called after the encryption from the final() method is complete.

cipher.getIV()

If the IV is passed in createCipheriv(), then the returning IV is identical. The returned value is a Buffer object.

cipher.setAAD(buffer)

Used for authenticated encryption modes. The encryption mode must be Encrypt-then-MAC. The data type can be a Buffer or Buffers object.

cipher.setAutoPadding(auto_padding=true)

You can disable automatic padding of the input data to block size. If auto_padding=false, the length of the entire input data must be a multiple of the cipher's block size or final() fails. You must call this method before cipher.final().

cipher.update(data[, encoding])

The encoding must be'utf8' or 'ascii'. If no encoding is provided, then a Buffer is expected. If data is a Buffer, then encoding is ignored.

crypto.createCipheriv(algorithm, key, iv)

The A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 algorithms need to be Encrypt-then-MAC.

For more information about formats when defining a key object, see Key object usage.

The iv must be a Buffer and is optional. If it does not present, an auto-generated IV is used. In this case, getIV() returns an auto-generated IV.

var crypto = require('crypto');
var cipher = crypto.createCipheriv('A128CBC-HS256', 'alice');
var aad = new Buffer('additional authentication data');
cipher.setAAD(aad);
cipher.update('this is the plaintext that needs to be encrypted');
cipher.update('second part');
var encipherData = cipher.final();
var authTag = cipher.getAuthTag();
var iv = cipher.getIV();

crypto.createDecipheriv(algorithm, key, iv)

The A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 algorithms need to be Encrypt-then-MAC.

For more information about formats when defining a key object, see Key object usage.

The iv must be a Buffer.

var decipher = crypto.createDecipheriv('aes192-cbc', 'alice', iv); 
decipher.update(encipherData);
var originalPlainText = decipher.final();

decipher.final([encoding])

The encoding must be 'ascii' or 'utf8'. If no encoding is provided, then a Buffer is returned.

Note: The decipher object cannot be used after the final() method is called.

decipher.setAAD(buffer)

Used for authenticated encryption modes. The encryption mode must be Encrypt-then-MAC. The data type can be a Buffer or Buffers object.

decipher.setAuthTag(buffer)

Used for authenticated encryption modes. The encryption mode must be Encrypt-then-MAC. If no tag is provided or if the ciphertext is tampered with, final() throws. The throw indicates that the ciphertext is to be discarded due to failed authentication. The data type must be a Buffer.

decipher.setAutoPadding(auto_padding=true)

You can disable automatic padding if the data is encrypted without standard block padding to prevent decipher.final() from checking and removing it. It works only if the length of the input data is a multiple of the ciphers block size. You must call this method before you stream data to decipher.update().

decipher.update(data[, encoding])

The encoding must be 'base64' or 'hex'. If no encoding is provided, then a Buffer is expected. If data is a Buffer, then encoding is ignored.

crypto.createSign(algorithm)

The crypto sign API is general purpose and uses an asymmetric key (public/private) mechanism to generate the signature. It does not include a symmetric key sign.

var crypto = require('crypto');
var key = "Alice";

var sign = crypto.createSign('rsa-sha256');
sign.update('This is text to sign').sign(key, function(error, signature) {
  if (error) {
    console.error("sign error "+error);
  } else {
    console.log("signature with rsa-sha256 is "+signature.toString('base64'));
    session.output.write(signature);
  }
});

sign.sign(key[, output_encoding], function(error, signature) {...})

For more information about formats when defining a key object, see Key object usage.

The output_encoding can 'hex' or 'base64'. If no encoding is provided, then a Buffer is returned.

The error is an instance of the GatewayScript error object. If no error occurs, the error variable is null.

The signature is the final result of the digital signature. The signature type must be string or Buffer, which is based on the output_encoding value. If no encoding is provided, then a Buffer is returned. If an error occurs, the signature is null.

The sign object cannot be used after the sign() method is called.

sign.update(data[, input_encoding])

The data type must be string, Buffer, or Buffers. If no encoding is provided and the input is a string, an encoding of 'utf8' is enforced. If data is a Buffer or Buffers, then input encoding is ignored. The input_encoding must be 'utf8' or 'ascii'.

crypto.createVerify(algorithm)

The crypto verify API is general purpose and is using an asymmetric key (public/private) mechanism to verify the signature. It does not include a symmetric key verify.

var crypto = require('crypto');
var key = "Alice";

session.input.readAsBuffer(function(error, buffer) {
  if (error) {
    console.error("readAsBuffer error: "+error);
  } else {
    var verify = crypto.createVerify('rsa-sha256');
    verify.update('This is text to sign').verify(key, buffer, function(error) {
      if (error) {
        console.error("verification fail: "+error);
      }
    });
  }
});

verify.update(data[, input_encoding])

The data type must be a string, Buffer, or Buffers. If no encoding is provided and the input is a string, an encoding of 'utf8' is enforced. If data is a Buffer or Buffers, then input encoding is ignored. The input_encoding must be 'utf8' or 'ascii'.

verify.verify(key, signature[, signature_encoding], function(error) {...})

For more information about formats when defining a key object, see Key object usage.

The signature must be a string, Buffer, or Buffers. If no encoding is provided and the signature is a string, an encoding of 'base64' is enforced. If signature is a Buffer or Buffers, then signature encoding is ignored.

The signature_encoding must be 'hex' or 'base64'.

The error is an instance of the GatewayScript error object. If the verify() call succeeds, the error variable is null.

The verify object cannot be used after the verify() method is called.

crypto.randomBytes(size[, function (error, buffer)])

The size must be a value in the range 1 - 2000000000.

The function passes random bytes in an asynchronous way. Otherwise, the random bytes are the function's return value.

The error happens if random byte generation is not able to perform. If callback does not present, an exception is thrown. Otherwise, the error is passed into callback function.