In this lesson, we're going to learn how to take plaintext passwords and store them in the database
in a secure way.
We are going to be using for that the built in Node crypto module.
So we are not going to be introducing a third party library.
Instead, we are just going to use plain functionality that already comes back in with Node.
Here is the function that we're going to be using to calculate the password hash.
We are going to be using the crypto module from Node, and the function that we're going to be using
is called PBC DF two.
I know that this is a little bit intimidating as a name, but let's have a look at what it means.
It's a password based key derivation function version two.
So that's all it means.
This function takes in a plain text password, assault and a couple of other parameters that we are
going to talk about.
It takes in a callback function and it calculates the password hash.
When the function finishes, the calculation of the password hash, it calls the callback and provides
the hash using this parameter of the callback, which is the derived key.
So it's really that simple.
It's just a plain function that takes in the password, the salt, and gives you a callback to tell
you when the password hash is ready.
Let's have a look at it in action before even using it in our program.
Switching back here to our workspace, we're going to head over to the terminal and we're going to start
Node with Node up and running.
The first thing that we want to do is to grab a reference to the crypto module.
So this module, we did not have to install any package in node modules to be able to use it.
This module comes built in with the node engine.
So let's go ahead and let's require here the crypto module.
With the crypto module, we are now going to have access to the password key base derivation function.
We can access it like this.
We are going to call here crypto and then we're going to access here the function PVC DF two and this
function is in the synchronous function.
So it's going to take a callback at the end, but the first thing that is going to need is the plaintext
password.
So I'm going to show you how to calculate the password hash for this function here.
So the password here is going to be test next.
After the plaintext password, we need the password salt that is unique per user.
Let's go ahead and let's paste it in.
Now we need a couple more parameters.
So the first parameter is going to be the number of iterations that we want to use this function.
This means that we are going to calculate the hash not only once, but several times.
We're going to calculate one hash once.
We are going to take that output and we are going to run it through the function again and again until
we reach a certain number that we're going to pass in here.
Let's say that we want to calculate the hash a thousand times.
You might be thinking, why would we want to rehash the same password a thousand times?
Well, this is done in order to increase the computational power required to try to break the password
of each user.
So imagine that you want to verify if the password of the user matches a predefined list of commonly
used passwords.
And you want to do that for all the users in the database.
Well, having to hash every single attempt a thousand times greatly increases the difficulty of the
task for the attacker that is trying to guess the user password.
So we hash each password multiple times in order to increase the computational power and the time needed
to try to guess the password of a single user.
After the number of times that we want to hash the password, we also want to define the length of the
password hash.
Let's use 64 bytes, which is a good standard for the industry.
And let's also choose the algorithm that we want to use to perform each of these hashes.
We have multiple algorithms available, but a very popular one that is still in use today is the SHA
512 algorithm.
So again, another name that might be a little bit intimidating.
This is just the name of a digest algorithm, a hashing algorithm that takes an input and calculates
an output.
The main property of this algorithm is that this process is irreversible.
Even the output.
There is no way for an attacker to guess the input.
So this function share 512 from a cryptographic standpoint gives us the guarantee that it's impossible
to reverse the output of this function.
It's simply not possible to get the input data from the output date.
The last parameter that we need to pass to this password.
Key derivation function is going to be a callback.
The callback is a function that is going to take in a couple of parameters.
So the first parameter is the error.
So this is the normal convention in the callback, and the second parameter is the output of the calculation.
In this case, the hash value that was hashed based on the input which is here, the password and the
password salt to implement this callback we are going to use here console.log and we are going to log
out to the console, the hash that we have just received and we are going to convert this into a string
because this is not going to come to us in a string form.
This is going to be a buffer object.
So we want to convert it to a string and let's make this an extra decimal string.
And with this, we have completed the call here to our password key derivation function.
Let's go ahead and let's run it.
And as we can see, we get this output to the console, this calculated value that you see here.
This is the password hash and this is what we're going to be storing in the database instead of the
plaintext password.
As you can see, by storing the hash in the database instead of the plaintext password makes it that
much harder for any attacker that gets access to our database to be able to guess the user password.
You might be thinking though, how are we going to be using the password hash, which is this value
here that is stored in the database in order to log in a user?
Well, it's very simple.
Any user that tries to log into our rest API is going to be sending to a rest login endpoint its user
name or email and its plaintext password.
So the user is going to be filling in a form with these two values here that are going to be sent to
our login endpoint.
Our login endpoint is then going to take the password, salt the plaintext password, and it's going
to calculate the hash again and then it's going to compare it with the hash that gets stored in the
database.
If there is a match between both, then it means that the user has entered the correct password.
So now that we understand how this password key derivation function works, let's then go ahead and
use it here in our popular TV script in order to fill in the password hash, which is the last property
that we need here in our use entity before saving it into the database.