NodeJS: bcrypt vs native crypto

Question

Can someone point out the differences between the two and example situations where use each?

bcrypt looks great.

Thirtythree

Answer 1

Use bcrypt where you want to do slow and computationally expensive hashing -- this will generally be for hashes where you really don't want an attacker to be able to reverse the hash, e.g. user passwords. Use native crypto for everything else.

Kavanaugh

Would you care to elaborate more on why bcrypt is better/stronger? I assume it uses a stronger/longer hash? Does it use a different algorithm? If so given two similar passwords, one hashed with native crypto and one with bcrypt what is the estimated cost in time for hash reversal? – Lamere

Bcrypt uses the Blowfish algorithm, which has a computationally expensive key setup phase. It then modifies it to allow the key setup to be iterated a configurable number of times -- typically something like 4,096 at present, but it can be increased as hardware becomes more powerful. The difference in difficulty of reverse hashing between bcrypt and a regular hash thus depends on the bcrypt configuration. – Kavanaugh

I don't understand this answer. Does "native" refer to nodejs's implementation of the Web Crypto API? If so, the API has key derivation strategies that allow to specify the number of iterations, so it can be made arbitrarily slow as well, right? – Wail

@Wail This answer is ten years old. At the time, node.js native crypto was far less functional than it is now. – Kavanaugh

@MikeScott if i want to store user info and credit card details should i use crypto or bcrypt? – Socialization

@Socialization You can’t protect stored information with bcrypt — it’s a password hashing algorithm, not an encryption algorithm. – Kavanaugh

@MikeScott thank you for getting back to me, so basically for passwords i use bcrypt and for info such as name, mobile number and address i use crypto? – Socialization

@Socialization These days you can use crypto for passwords as well. It implements both PKDF2 and scrypt— scrypt seems to be better, but I’m not as up-to-date as I was ten years ago. – Kavanaugh

@MikeScott thank you that really helped alot, i am still new to encryption. For info such as name, mobile number and address encryption do you suggest AES or SHA or etc..? – Socialization

@Socialization SHA is a hashing algorithm, not encryption. – Kavanaugh

@MikeScott should i hash or encrypt a users password or should i hash then encrypt? – Socialization

@Socialization Hash only. You don’t want to be able to recover the users password. – Kavanaugh

@MikeScott What i dont understand is if i use bcrypt i can hash the password when storing but then i can compare to user input then log user in, whats the difference between that and encryption? – Socialization

@Socialization The difference is that an attacker who gets both your database and encryption keys can’t recover the passwords. – Kavanaugh

@MikeScott thank you alot, what about information such as users name should i encrypt this twice once using users password then again using secret key? – Socialization

Answer 2

I would use nodejs's native crypto library

I think the decision should not be just based on who does what better, it is much more than that

You should know why node.js included an inbuilt module for crypto, while it was not originally part of node.js and many libraries were popular in npm repository, including bcrypt

The reason was, cryptography is an important security aspect, using an external module from npm has the possibility of malicious code injected, which defeats original security objective

Hence need a trusted library for such cryptographic function, which was the motivation for nodejs to provide such a library

If you think the cryptographic method is not strong, better raise issue on nodejs about same instead of blindly trusting an external library

Still don't believe me? read this article https://hackernoon.com/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5

Hypoacidity

You should prefer bcrypt because it's slow by design. When someone is brute forcing your site or has stolen your database, you'll want it to be computationally expensive to process each password. It'll take the same amount of time on any machine which saves you from GPU power – Hypotonic

Maybe crypto didn't have this back when other answers and comments were posted, but (as of at least 2020) nowadays I agree with Basav. Node's crypto has pssword derivation functions such as scrypt so I'd consider it much safer to use the built-in solution. – Dingo

Hi, do you suggest me to use bycrypt js or crypto js? – Socialization

Go for crypto lib from NodeJS, test your scenarios well – Hypoacidity

@Hypoacidity so if i am developing a banking app, should i use crypto to encrypt everything i store in my db? – Socialization

This is my preferred answer in 2021. Be careful to whom you delegate trusted crypto tasks. – Spindling

Answer 3

In companion with the @mike-scott's answer, you should prefer bcrypt for password related stuff but still you can use crypto for a wide range of tasks like create random tokens or a HMAC checksum or SHA1/MD5 hashes:

var crypto = require('crypto'); 

// random tokens
var buf = crypto.randomBytes(16).toString('hex');
console.log('Random token of %d bytes in hexadecimal: %s', buf.length, buf);
var buf = crypto.randomBytes(16).toString('base64');
console.log('Random token of %d bytes in base 64: %s', buf.length, buf);

// a hashed message authentication checksum (HMAC) using a shared secret key
var string = 'My coffee please';
var key = 'Right away sir';

var encrypted = crypto.createHmac('sha1', key).update(string).digest('hex');
console.log('Encrypting "%s" using passphrase "%s": %s', string, key, encrypted);

// a MD5 hash
var hashmd5 = crypto.createHash('md5').update(string).digest('hex');
console.log('The MD5 hash of "%s" is %s', string, hashmd5); 

// a SHA1 hash
var hashsha1 = crypto.createHash('sha1').update(string).digest('hex');
console.log('The SHA1 hash of "%s" is %s', string, hashsha1); 

Kaon

Answer 4

With new nodejs versions scrypt function from crypto module can be used for hashing passwords.

This is from the nodejs documents: Scrypt is a password-based key derivation function that is designed to be expensive computationally and memory-wise in order to make brute-force attacks unrewarding.

Dyak

Answer 5

According to me bcrypt is better i have made to websites one is an mern ecommerce site and other is mern social network and bcrypt provides better functions than crypto it is according to you

npm install bcrypt

Radu