Crypto APIs والأسرار: random و hash و HMAC و AES-GCM

import crypto from "node:crypto";

console.log(crypto.randomUUID());
console.log(crypto.randomBytes(32).toString("base64url"));
console.log(crypto.randomInt(100000, 1000000));

// ❌ Math.random مش للأمان: ممكن يتوقّع
console.log(Math.random());

$ node --env-file=.env main.js
60588315-990c-42e5-a1d9-1801fa5ea349
pXjbT0PFfQaDuW7Z9de5QJaAAsVYLWMtyNx6gm-Gk1M
151099
0.47506451911349035

import crypto from "node:crypto";

const sha = (s) => crypto.createHash("sha256").update(s).digest("hex");

console.log(sha("hello"));
console.log(sha("hello"));
console.log(sha("hellp"));

// hash لملف كامل بالـ stream (زي اللي بيعمله npm للـ packages)
import fs from "node:fs";
import { pipeline } from "node:stream/promises";
const h = crypto.createHash("sha256");
await pipeline(fs.createReadStream("package.json"), h);
console.log("package.json:", h.digest("hex").slice(0, 16), "…");

$ node --env-file=.env main.js
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
fdd7585e08c4e2afd71dcabdb4636c89d557a3f42db9e2040c8bbd1708aa4ce7
package.json: 3ca9d4afd2142508 …

import crypto from "node:crypto";

const SECRET = process.env.WEBHOOK_SECRET;

function sign(body) {
  return crypto.createHmac("sha256", SECRET).update(body).digest("hex");
}

function verify(body, signature) {
  const expected = Buffer.from(sign(body), "hex");
  const given = Buffer.from(signature, "hex");
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

const body = JSON.stringify({ orderId: 7, amount: 250 });
const sig = sign(body);
console.log("signature:", sig.slice(0, 16), "…");
console.log(verify(body, sig));
console.log(verify(body.replace("250", "1"), sig));
console.log(verify(body, "00".repeat(32)));

$ node --env-file=.env main.js
signature: 329f2067edd1e3ad …
true
false
false

import crypto from "node:crypto";

// المفتاح 32 byte = 256 bit، جاي من env (base64)
const key = Buffer.from(process.env.DATA_KEY, "base64");

function encrypt(text) {
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
  const data = Buffer.concat([cipher.update(text, "utf8"), cipher.final()]);
  return { iv, data, tag: cipher.getAuthTag() };
}

function decrypt({ iv, data, tag }) {
  const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
  decipher.setAuthTag(tag);
  return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8");
}

const box = encrypt("رقم البطاقة: 4111 1111 1111 1111");
console.log(box.data.toString("base64"));
console.log(decrypt(box));

const again = encrypt("رقم البطاقة: 4111 1111 1111 1111");
console.log("نفس النص، نفس الناتج؟", again.data.equals(box.data));

box.data[0] ^= 1; // حد غيّر bit واحد
try {
  decrypt(box);
} catch (err) {
  console.log("اتكشف التلاعب:", err.message);
}

$ node --env-file=.env main.js
WcqoIoUp6OWi0Rdat82XsDOVY79NLShBsWjOc9QJS/wuuhaVJC7wx+fq
رقم البطاقة: 4111 1111 1111 1111
نفس النص، نفس الناتج؟ false
اتكشف التلاعب: Unsupported state or unable to authenticate data

import crypto from "node:crypto";

const key = Buffer.from(process.env.DATA_KEY, "base64");
const b64 = (b) => b.toString("base64url");

function seal(text) {
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
  const data = Buffer.concat([cipher.update(text, "utf8"), cipher.final()]);
  return ["v1", b64(iv), b64(cipher.getAuthTag()), b64(data)].join(".");
}

function open(sealed) {
  const parts = sealed.split(".");
  if (parts.length !== 4 || parts[0] !== "v1") throw new Error("bad format");
  const [iv, tag, data] = parts.slice(1).map((p) => Buffer.from(p, "base64url"));
  const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
  decipher.setAuthTag(tag);
  return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8");
}

const a = seal("01001234567");
console.log(open(a));
console.log("seal مرتين ← مختلفين:", a !== seal("01001234567"));
for (const bad of [a.slice(0, -1) + (a.at(-1) === "A" ? "B" : "A"), "v2.a.b.c"]) {
  try {
    open(bad);
  } catch (err) {
    console.log("Error:", err.message);
  }
}

$ node --env-file=.env main.js
01001234567
seal مرتين ← مختلفين: true
Error: Unsupported state or unable to authenticate data
Error: bad format