使用内置`crypto`的nodejs中的密码散列

Question

仅使用内置 crypto 模块在 node.js 中实现密码哈希和验证的最佳方法是什么。 基本上需要什么：

function passwordHash(password) {} // => passwordHash
function passwordVerify(password, passwordHash) {} // => boolean

人们通常为此使用bcrypt 或其他第三方库。我想知道内置的crypto 模块还不够大，至少可以满足所有基本需求吗？

scrypt() 似乎是此目的的合适人选，但没有经过验证的对应对象和 nobody seems to care。

Answer 1

import { scrypt, randomBytes } from "crypto";
import { promisify } from "util";

// scrypt is callback based so with promisify we can await it
const scryptAsync = promisify(scrypt);

哈希过程有两种方法。第一种方法，您对密码进行哈希处理，第二种方法，您需要将新的登录密码与存储的密码进行比较。我用打字稿写的很详细

export class Password {
  static async toHash(password: string) {
    const salt = randomBytes(8).toString("hex");
    const buf = (await scryptAsync(password, salt, 64)) as Buffer;
    return `${buf.toString("hex")}.${salt}`;
  }
  static async compare(storedPassword: string, suppliedPassword: string) {
   // split() returns array
    const [hashedPassword, salt] = storedPassword.split(".");
   // we hash the new sign-in password
    const buf = (await scryptAsync(suppliedPassword, salt, 64)) as Buffer;
   // compare the new supplied password with the stored hashed password
    return buf.toString("hex") === hashedPassword;
  }
}

Answer 2

const password = "my_password"; 

// Creating a unique salt for a particular user
const salt = crypto.randomBytes(16).toString('hex'); 
  
// Hash the salt and password with 1000 iterations, 64 length and sha512 digest 
const hash = crypto.pbkdf2Sync(password, salt, 1000, 64, 'sha512').toString('hex');

将用户的salt 和hash 存储在DB 中。

const re_entered_password = "my_password";

// To verify the same - salt (stored in DB) with same other parameters used while creating hash (1000 iterations, 64 length and sha512 digest)
const newHash = crypto.pbkdf2Sync(re_entered_password, salt, 1000, 64, 'sha512').toString('hex');

// check if hash (stored in DB) and newly generated hash (newHash) are the same
hash === newHash;