I am integrating a payment gateway for my node.js project. They have integration kit in python and i don't have much experience in it. I ported their change from python to javascript. Is this correct ?
Python code:
def encrypt(plainText,workingKey):
iv = 'hello'
encDigest = md5.new ()
encDigest.update(workingKey)
enc_cipher = AES.new(encDigest.digest(), AES.MODE_CBC, iv)
encryptedText = enc_cipher.encrypt(plainText).encode('hex')
return encryptedText
Ported Code (Node.js):
function encrypt(plainText, workingKey){
var iv = 'hello';
var encDigest = crypto.createHash('md5');
encDigest.update(workingKey);
var enc_cipher = crypto.createCipheriv('aes-256-cbc', encDigest, iv);
var encryptedText = enc_cipher.encrypt(plainText).encode('hex');
return encryptedText;
}
md5shouldn't be used in security applications IMO. And I'm not sure whether theivshould not be a static value... like, payment is something very sensitive;