11. Node.js Crypto Module: Password Hashing (Argon2 vs bcrypt) & AES-256-GCM • Node.js Backend Architecture: Libuv to High-Scale Microservices • Rishabh Ki Kaksha

Node.js Backend Architecture: Libuv to High-Scale Microservices › 11. Node.js Crypto Module: Password Hashing (Argon2 vs bcrypt) & AES-256-GCM

40 mins

← Prev Next →

Course Syllabus

Module 1: Node.js Internals, Libuv & Event Loop Architecture

01. Node.js Architecture: V8, Libuv, C++ Bindings & Non-Blocking I/O 02. Libuv Event Loop 6 Phases: Timers, Pending, Poll, Check (setImmediate) & Close 03. process.nextTick vs setImmediate vs queueMicrotask (Starvation Traps)

Module 2: Buffers, Binary Protocols & Stream Pipelines

04. Buffer Allocation: Buffer.alloc vs Buffer.allocUnsafe & Memory Security 05. Node.js Streams: Readable, Writable, Duplex & Transform Streams 06. Backpressure Management & stream.pipeline vs .pipe() Gotchas

Module 3: Enterprise Express & High-Scale REST API Architecture

07. Production Express Architecture: Controller-Service-Repository Pattern 08. Custom Global Error Handling, Async Handlers & Zod Request Validation 09. High-Performance Caching with Redis & Invalidation Strategies

Module 4: Authentication, Cryptography & Web Security

10. Authentication Architecture: JWT Access/Refresh Tokens & Sliding Sessions 11. Node.js Crypto Module: Password Hashing (Argon2 vs bcrypt) & AES-256-GCM 12. API Security Hardening: Helmet, CORS, Rate Limiting & OWASP Defenses

Module 5: Concurrency, Clustering & Worker Threads

13. Child Processes: spawn vs exec vs execFile vs fork 14. Multi-Core Clustering: Node.js Cluster Module & Zero-Downtime Reloads 15. Worker Threads (worker_threads) & SharedArrayBuffer for CPU-Bound Tasks

Module 6: Microservices, Message Queues (BullMQ/RabbitMQ) & Production Ops

16. Real-Time WebSockets Architecture: Socket.io with Redis Adapter Scaling 17. Asynchronous Task Queues with Redis & BullMQ (Retries, Backoff, Dead Letters) 18. Microservices Architecture: gRPC Protocols with Protocol Buffers in Node.js 19. Observability: Winston Structured Logging, OpenTelemetry & Prometheus Metrics 20. Production PM2 Cluster Deployment, Memory Leak Profiling (heapdump) & Healthchecks

Interactive Lesson Studio

# 11. Node.js Crypto Module: Password Hashing (Argon2 vs bcrypt) & AES-256-GCM

> Node.js Notes by Rishabh - Topic 11

---

### 1. Password Hashing: Why MD5 & SHA-256 Are Dead ⚰️

MD5 aur SHA-256 fast cryptographic hash functions hain — hacker GPU cluster se **1 second me 100 Billion hashes** brute-force kar sakta hai!

**Password Hashing Competition Winner: Argon2id 👑**
*   **Memory-Hard:** Argon2 ko calculate karne ke liye dedicated RAM (e.g. 64MB per hash) chahiye, jo GPU / ASIC parallel brute-force cracking ko impossible bana deta hai!

```typescript
import argon2 from "argon2";

// 1. Hash Password with Salt:
const hash = await argon2.hash("SuperSecret123!", {
    type: argon2.argon2id,
    memoryCost: 2 ** 16, // 64 MB RAM
    timeCost: 3          // 3 Iterations
});

// 2. Verify Password:
const isMatch = await argon2.verify(hash, "SuperSecret123!"); // true / false
```

---

### 2. Symmetric Data Encryption: AES-256-GCM (Authenticated Encryption) 🔐

Database me PII data (Credit Cards, Aadhaar numbers) encrypt karke store karna:

```typescript
import crypto from "crypto";

const ALGORITHM = "aes-256-gcm";
const KEY = crypto.randomBytes(32); // 256-bit secret key from ENV

export function encrypt(plainText: string) {
    const iv = crypto.randomBytes(12); // 96-bit IV
    const cipher = crypto.createCipheriv(ALGORITHM, KEY, iv);

let encrypted = cipher.update(plainText, "utf8", "hex");
    encrypted += cipher.final("hex");

const authTag = cipher.getAuthTag().toString("hex"); // Tamper-proof tag!

return {
        iv: iv.toString("hex"),
        content: encrypted,
        tag: authTag
    };
}

export function decrypt(encryptedData: { iv: string; content: string; tag: string }) {
    const decipher = crypto.createDecipheriv(ALGORITHM, KEY, Buffer.from(encryptedData.iv, "hex"));
    decipher.setAuthTag(Buffer.from(encryptedData.tag, "hex"));

let decrypted = decipher.update(encryptedData.content, "hex", "utf8");
    decrypted += decipher.final("utf8");
    return decrypted;
}
```

---

### 3. Master Comparison Matrix

---

### 4. Interview Ke 3 Sawal Is Topic Se

1. **AES-GCM mode AES-CBC mode se kyu behtar hai?** -> GCM (Galois/Counter Mode) authenticated encryption provide karta hai jo cipher text ke sath `AuthTag` generate karta hai, jisse ciphertext tampering (Padding Oracle Attacks) impossible ho jaati hai.
2. **Password hashing me Salt ka kya role hota hai?** -> Salt random unique bytes add karta hai jisse do users ke password same hone par bhi unka hash alag banta hai aur pre-computed **Rainbow Table attacks** fail ho jaate hain.
3. **`crypto.randomBytes` vs `Math.random` me kya security difference hai?** -> `crypto.randomBytes` OS CSPRNG (Cryptographically Secure Pseudo-Random Number Generator) se unpredictable entropy leta hai jabki `Math.random` predictable PRNG algorithm use karta hai.

---
**Next Topic:** 12. API Security Hardening: Helmet, CORS, Rate Limiting & OWASP Defenses

Loading lesson content...

JavaScript

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track