net-cipher

❌ Beware 0xBAADC0DE! The "crypto" applied within this module has serious flaws. ❌

---

An encryption utility for net servers and clients, generally node duplex streams. Features message authentication.

Before using this in any setting that requires secure encryption, reimplement the encryption keystreaming part of this module.

---

Installation

npm install --save net-cipher

---

Usage

The usage directory contains an example server and client that demonstrate how to establish an encrypted and authenticated TCP connection.

Server

Run node ./usage/server to start the demo server below.

var net = require('net')
var cipherConnection = require('net-cipher')
 
var server = net.createServer(cipherConnection(oncipherconnection))
 
function oncipherconnection (err, socket) {
  if (err) return console.error(err)
  socket.once('data', function ondata (chunk) {
    console.log(chunk.toString()) // prints whatever the client sent
    server.close()
  })
}
 
server.listen(419, '127.0.0.1', function () {
  var addy = server.address()
  console.log('server live @ ' + addy.address + ':' + addy.port)
})

Client

Then, run node ./usage/client to connect to the demo server with the client below.

var net = require('net')
var cipherConnection = require('net-cipher')
 
var clientCipher = cipherConnection()
 
function oncipherconnect (err, socket) {
  if (err) return console.error(err)
  socket.end('fun stuff')
}
 
var socket = net.connect(419, '127.0.0.1', function () {
  clientCipher(socket, oncipherconnect)
})

---

API

var cipher = cipherConnection([opts][, oncipher(err, duplex)])

Create a function that is capable of encrypting and authenticating any duplex stream.

Options default to:

{
  algo: 'alea',
  mac: true,
  delimiter: Buffer.from([ 0x00, 0x04, 0x01, 0x09, 0x04, 0x01, 0x09, 0x00 ])
}

opts.algo indicates the algorithm to use as the random number generator for the keystreams of internal xor-stream-cipher and siphash24-stream instances, defaults to 'alea'. Check out seedrandom for a list of supported algorithms. opts.mac indicates whether to incorporate a message authentication check via siphash24-stream. opts.delimiter indicates the message boundary to use for the (optional) message authentication procedure, must be a buffer.

Optionally, pass a function, sig oncipher(err, duplex), and it will be bound to cipher as its callback.

The returned function, cipher, is designed to be the very first connection handler to be used with net.createServer, net.connect, and alike.

cipher(duplex[, oncipher(err, duplex)])

Encrypt any duplex stream by using the ECDHE protocol with Daniel Bernstein's curve25519 to obtain a shared secret, which is in turn used to seed pseudo-random keystreams of xor-stream-cipher and siphash24-stream instances that perform the actual en/decryption and message authentication.

The callback has the signature oncipher(err, duplex) with duplex being the encrypted stream. oncipher is required, and will only be considered, if it has not been passed in the call of cipherConnection.

---

License

MIT