Best way to encrypt and decrypt persisted data in Node.JS?

Question

I'm writing a Node.JS application that will store chat logs to a datastore (i.e. MongoDB), along with some other user information. I'm already using bcrypt to store salted hashes for user passwords, so I'm covered there.

What the best method of encrypting persisted data? I'm talking about sensitive user data such as phone numbers, and the chat logs. If my database gets compromised, I don't want this information being usable.

I do need two-way encryption/decryption, however, because I need to be able to use the plain-text values (i.e. the phone numbers are for Twilio, the chat logs are for users to see their old messages).

I'm looking into node-crypto but I haven't been able to find any examples of doing this in a performant/realtime fashion.

UPDATE: I should've mentioned that the chat "logs" are actually full conversations that get pushed to "rooms" in real-time when users join them (i.e. they can see the entire chat history, or at least a subset of it). So, I'd need to be able to encrypt and decrypt on the fly pretty quickly (if not in real-time, at least with some sort of worker process).

Raynos · Accepted Answer · 2011-07-27 09:29:06Z

4

The best thing to do is use require('crypto').

You will however need to port it to the clientside. Good luck with that. (Shouldn't be too hard with browserify)

answered Jul 27, 2011 at 9:29

Raynos

170k57 gold badges359 silver badges399 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Aashay Desai Over a year ago

Hmm, what's better, to use it server-side only (and send the plaintext to clients but using https) or to use it on the client as well, with browserify?

Aashay Desai Over a year ago

Looks like there are actually decent JS implementations available: code.google.com/p/crypto-js

Ryan McCarvill · Accepted Answer · 2011-12-01 02:55:08Z

0

Do it all server side, if you do it client side you will need to expose your encryption keys.

answered Dec 1, 2011 at 2:55

Ryan McCarvill

1314 bronze badges

3 Comments

Aashay Desai Over a year ago

Not necessarily. Using a public-key scheme or a Diffie-helman scheme with PBKDF'ed keys would allow browser clients to download password-protected private keys and encrypted data and decrypt entirely on the client-side. The unfortunate thing here is figuring out a way to "store" the private key locally. It'd be okay to use something like PersistJS, so that private keys are only exposed to the owners, but making sure they're cleaned up after a session expires becomes the tricky part.

Ryan McCarvill Over a year ago

They could still be accessed by writing the key variable to the console in something like firebug. If they are stored in browser storage they can also be queried.

Aashay Desai Over a year ago

Sure, but it's okay if a user sees their own private key, just like you can cat ~/.ssh/id_rsa and see your private key.

Collectives™ on Stack Overflow

Best way to encrypt and decrypt persisted data in Node.JS?

2 Answers 2

2 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related