What are the correct settings for crypto.pbkdf2 to output IV and the key for crypto.createCipheriv?

Question

In an application in node.js, I use a cryptographic module for symmetric encryption / decryption.

I am using AES-256-CTR. It was originally intended that crypto.createCipher would “just work” and “manually” drill down. Now I read in the documentation:

Note. createCipher derives keys using the OpenSSL function EVP_BytesToKey with the digest algorithm set in MD5, one iteration and no salt. Lack of salt allows you to use dictionary attacks, since the same password always creates the same key. The low level of iterations and the non-cryptographically secure hashing algorithm make password verification very fast.

As recommended by OpenSSL, using pbkdf2 instead of EVP_BytesToKey, it is recommended that you print the key and iv yourself crypto.pbkdf2, and then use createCipheriv () to create the encryption stream.

Well, I can get the IV and the key itself.

But I'm not sure what the correct and recommended way to do this is - should I make a key conclusion separately for both, with different salts? Should I draw one key conclusion and then cut it in half? Should I use salt at all for this particular use case? Should I randomly generate salt and save it with data?

Answer 1

Should I do key differentiation separately for both, with different salts?

You can do this, but a faster alternative with about the same security would be to use something like this:

var master = crypto.pbkdf2Sync(password, randomSalt, 60000, 256, 'sha256');
var hmac = crypto.createHmac('sha256', master);
hmac.update("key");
var key = hmac.digest();

hmac = crypto.createHmac('sha256', master);
hmac.update("nonce");
var nonce = hmac.digest().slice(0,12); // 96 bit for CTR nonce

Should I draw one key conclusion and then cut it in half?

, , . AES-256 (256 ) nonce (IV) 64 128 , SHA-384 (sha384) SHA-512 (sha512) digest, node.js.

?

, , , , + nonce.

, nonce. , nonce randomly () .

​​ , , . , , ...

. , .

, MAC :

hmac = crypto.createHmac('sha256', master);
hmac.update("hmac");
var hmacKey = hmac.digest();

// TODO encrypt

hmac = crypto.createHmac('sha256', hmacKey);
hmac.update(ciphertext);
var authenticationTag = hmac.digest();

, .

, GCM, node.js.