sheercms/lib/crypto.js

Sheer Cliff CMS is a simple and powerful content management system (CMS) for Node JS.

/*
Crypto - used for encryption/decpryption and hashing passwords
 */

var crypto = require('crypto');
var logger = require('./logger');

//all plugins should provide a default config
module.exports.config = {
    name: "PBKDF2 Crypto",
    key: "crypto",
    desc: "Provides PBKDF2 hashing for user authentication.",
    type: "System",
    settings: {}
};

module.exports.init = function(server, done) {
    done();
};

/*
callback: err, result
 */
module.exports.hashPassword = function(password, callback) {
    if (callback) {
        var salt = crypto.randomBytes(16).toString('base64');
        var key = null;

        crypto.pbkdf2(password, salt, 10000, 128, function (err, dk) {
            if (err) {
                logger.error(err);
                callback(err);
            }
            else {
                var baseKey = new Buffer(dk, "binary").toString("base64");
                key = "{X-PBKDF2}:128:10000:" + salt + ":" + baseKey;
                callback(null, key);
            }
        });
    }
};

/*
callback: err, isMatch
 */
module.exports.testPassword = function(password, hash, callback) {
    try {
        var arr = hash.split(':');
        if (arr && arr.length == 5) {
            var length = parseInt(arr[1]);
            var iterations = parseInt(arr[2]);
            var salt = arr[3];
            var dkValue = arr[4];
            crypto.pbkdf2(password, salt, iterations, length, function (err, dk) {
                if (err) {
                    logger.error(err);
                    if (callback) callback(err);
                }
                else {
                    var baseKey = new Buffer(dk, "binary").toString("base64");
                    var isMatch = (baseKey == dkValue);
                    if (callback) callback(null, isMatch);
                }
            });
        }
        else {
            var e = new Error("Invalid hash format.");
            logger.error(e);
            if (callback) callback(e);
        }
    }
    catch(e) {
        logger.error(e);
        if (callback) callback(e);
    }
};