Applied Cryptography Lab: The Avalanche Effect, Symmetric AES-GCM vs RSA, and Key Derivation

// Modern Secure Cryptography in Node.js (Crypto & Web Crypto API)
import crypto from 'node:crypto';

// 1. SECURE PASSWORD HASHING WITH ARGON2id (or Scrypt / Bcrypt)
export async function hashPassword(password: string): Promise<string> {
  const salt = crypto.randomBytes(16);
  // Argon2id or scrypt with memory cost
  return new Promise((resolve, reject) => {
    crypto.scrypt(password, salt, 64, { N: 16384, r: 8, p: 1 }, (err, derivedKey) => {
      if (err) reject(err);
      // Format: salt:derivedKey
      resolve(salt.toString('hex') + ':' + derivedKey.toString('hex'));
    });
  });
}

// 2. SECURE SYMMETRIC ENCRYPTION WITH AES-256-GCM
export function encryptAesGcm(plaintext: string, keyBuffer: Buffer) {
  // 96-bit (12 bytes) IV: MUST BE UNIQUE PER OPERATION
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', keyBuffer, iv);

  let ciphertext = cipher.update(plaintext, 'utf8', 'hex');
  ciphertext += cipher.final('hex');

  // 128-bit Authentication Tag
  const authTag = cipher.getAuthTag();

  // Transmit IV + AuthTag + Ciphertext
  return {
    iv: iv.toString('hex'),
    tag: authTag.toString('hex'),
    ciphertext
  };
}