DEV Community

Discussion on: Encrypt and Decrypt Data in Node.js using aes-256-cbc

View post
Collapse
 
hugotox profile image
Hugo Pineda •

Thanks for this article!! I have a question about this bit

// Generate secret hash with crypto to use for encryption
const key = crypto
  .createHash('sha512')
  .update(secret_key)
  .digest('hex')
  .substring(0, 32)
const encryptionIV = crypto
  .createHash('sha512')
  .update(secret_iv)
  .digest('hex')
  .substring(0, 16)
Enter fullscreen mode Exit fullscreen mode

If I understood correctly, this will generate the key and encryptionIV values, which will be constants, so why not just saving those already calculated values in the .env file directly?

Collapse
 
jobizil profile image
Ugbem Job •

It's not a good practice to save them in the env as every encryption hash is expected to have its own unique encryption key.