Deriving a Password Key
Part of the Auth and Security section of Coddy's Node.js journey. Lesson 2 of 24.
A password key is computed from a password and a salt. Unlike encoding, this calculation is not designed to be reversed. Scrypt makes password guesses expensive by requiring work for each attempt. With the same password, salt and derivation settings, including key length, the key is reproducible. This derived key is commonly called the password hash.
const key = await scryptAsync('invite 4821', 'example-only', 16);
return key.toString('hex');The third argument is the key length in bytes. The provided helper uses promisify to turn Node's callback-based scrypt into a function returning a promise. You can await it like a file read. The fixed salt in this practice lets you compare results; real password storage uses a fresh random salt.
The next practice generates the fresh random salt needed when storing a new password.
Challenge
EasyThis is a small practice project. Its setup is provided; edit only exercise.js.
Finish the function: derive a 32-byte key from the supplied password and salt, then return its hex text in key. POST {"password":"practice","salt":"fixed-for-this-exercise"} twice to /result: the same 64-character key appears. Change either input and the key changes.
Try it yourself
import { scryptAsync } from './crypto.js';
export async function exercise({ password, salt }) {
return { key: password };
}
All lessons in Auth and Security
1Passwords
Bytes and Hex TextDeriving a Password KeyA Fresh SaltNever Store PasswordsComparing Key BytesChecking a PasswordSignup Rules
Practice on your own: Express playground