Share your code. npm Orgs help your team discover, share, and reuse code. Create a free org »

    fernetpublic

    Fernet.js

    Javascript implementation of Fernet symmetric encryption.

    Fernet is an opinionated way of using AES and HMAC authentication that makes shared-secret symmetric encryption simpler for communicating applications.

    Fernet.js uses browserify to provide a library that works in both node and the browser.

    Instead of using TypedArrays I use Hex Strings and CryptoJS's Hex.parse to build up CryptoJs.lib.WordArray objects.

    WARNING

    It's generally never considered safe to encrypt data in the browser.

    However, you can use this library to encrypt/decrypt data server-side and decrypt data on a client.

    That being said, the only randomness used by this library without your control is a call to crypto.randomBytes to generate IVs. This function defaults to OpenSSL server-side and browserify's random number generator implementation client-side. The browserify implementation only uses real browser crypto or throws an error. (IE: no calls to Math.random())

    If you're planning on generating the secrets in the browser do yourself a favor and get an audit.

    Use

    node.js

    var fernet = require('./fernet');

    browser

    <script src="fernetBrowser.js"></script>

    Fernet

    fernet.setSecret(string)

    Sets the secret at the top level for all further Tokens made from this instance of Fernet.

    fernet.ttl = seconds

    Sets the ttl at the top level for all further Tokens made from this instance of Fernet.

    Secret

    Generating a secret

    Generating appropriate secrets is beyond the scope of `Fernet`, but you should
    generate it using `/dev/random` in a *nix. To generate a base64-encoded 256 bit
    (32 byte) random sequence, try:
    
    dd if=/dev/urandom bs=32 count=1 2>/dev/null | openssl base64
    

    new fernet.Secret(string)

      var secret = new fernet.Secret("cw_0x689RpI-jtRR7oE8h_eQsKImvJapLeSbXpwF4e4=");
      /*
        {
          signingKeyHex: '730ff4c7af3d46923e8ed451ee813c87',
          signingKey: [CryptoJS.lib.WordArray],
          encryptionKeyHex: 'f790b0a226bc96a92de49b5e9c05e1ee',
          encryptionKey: [CryptoJS.lib.WordArray]
        }
      */

    Token

    new fernet.Token(options)

    Options:

    • secret: a fernet.Secret object
    • token: a Fernet-encoded String
    • ttl: seconds of ttl

    For testing:

    • time: Date object
    • iv: Array of Integers

    Token.prototype.encode

    //Have to include time and iv to make it deterministic.
    //Normally time would default to (new Date()) and iv to something random.
    var token = new fernet.Token({
      secret: secret,
      time: Date.parse(1),
      iv: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]
    })
    token.encode("Message")
    /*
    'gAAAAABSO_yhAAECAwQFBgcICQoLDA0OD1PGoFV6wgWZG6AOBfQqevwJT2qKtCZ0EjKy1_TvyxTseR_3ebIF6Ph-xa2QT_tEvg=='
    */

    Token.prototype.decode

    Include tt

    var token = new fernet.Token({
      secret: secret,
      token: 'gAAAAABSO_yhAAECAwQFBgcICQoLDA0OD1PGoFV6wgWZG6AOBfQqevwJT2qKtCZ0EjKy1_TvyxTseR_3ebIF6Ph-xa2QT_tEvg==',
      ttl: 0
    })
    token.decode();
     
    /*
    "Message"
    */

    Test

    > npm test
    

    Compiles new fernetBrowser.js via browserify, tests node lib with mocha, then opens test.html via open.

    install

    npm i fernet

    Downloadsweekly downloads

    413

    version

    0.3.1

    license

    MIT

    last publish

    collaborators

    • avatar