I am currently trying to encrypt data at rest with NodeJS, I have read in the Node API docs that
createCipher is not recommended.
The implementation of crypto.createCipher() derives keys using the
OpenSSL function EVP_BytesToKey with the digest algorithm set to MD5,
one iteration, and no salt. The lack of salt allows dictionary attacks
as the same password always creates the same key. The low iteration
count and non-cryptographically secure hash algorithm allow passwords
to be tested very rapidly.
In line with OpenSSL's recommendation to use pbkdf2 instead of
EVP_BytesToKey it is recommended that developers derive a key and IV
on their own using crypto.pbkdf2() and to use crypto.createCipheriv()
to create the Cipher object.
createCipher still a viable and secure way to encrypt data at rest? Should this method be considered deprecated?
Is it feasible for a well informed attacker to potentially decrypt data?
Should a solution using
createCipheriv always be preferred over
Any other details or recommendations appreciated.