What encryption method is used to encrypt Flow Credentials in order to trigger flows via HTTP API?

Shan · 12 January 2023 07:59

Based on the documentation for POST /flows : Node-RED it mentions the usage of encrypted password within the flow JSON request body. What is the encryption mechanism that is actually used? It doesn't look like bcrypt.

Any idea which mechanism is it?

TotallyInformation · 12 January 2023 15:05

While I don't know for certain, I would imagine it uses the same process as for the passwords: Securing Node-RED : Node-RED (nodered.org)

Which is indeed bcrypt. However, it does use a salt. From settings.js:

    /** By default, credentials are encrypted in storage using a generated key. To
     * specify your own secret, set the following property.
     * If you want to disable encryption of credentials, set this property to false.
     * Note: once you set this property, do not change it - doing so will prevent
     * node-red from being able to decrypt your existing credentials and they will be
     * lost.
     */
    credentialSecret: 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

knolleary · 12 January 2023 15:28

bcrypt is a password-hashing algorthm, not an encryption scheme. If we used bcrypt for the credentials, we'd never be able to decrypt them.

The code Node-RED uses to encrypt/decrypt credentials is here:

github.com

node-red/node-red/blob/master/packages/node_modules/@node-red/runtime/lib/nodes/credentials.js#L34-L46


      
          function decryptCredentials(key,credentials) {
              var creds = credentials["$"];
              var initVector = Buffer.from(creds.substring(0, 32),'hex');
              creds = creds.substring(32);
              var decipher = crypto.createDecipheriv(encryptionAlgorithm, key, initVector);
              var decrypted = decipher.update(creds, 'base64', 'utf8') + decipher.final('utf8');
              return JSON.parse(decrypted);
          }
          function encryptCredentials(key,credentials) {
              var initVector = crypto.randomBytes(16);
              var cipher = crypto.createCipheriv(encryptionAlgorithm, key, initVector);
              return {"$":initVector.toString('hex') + cipher.update(JSON.stringify(credentials), 'utf8', 'base64') + cipher.final('base64')};
          }

system · 26 January 2023 15:29

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Flows-cred.json decrypt/encrypt dependency General	4	318	15 July 2023
Are encrypted node-red Credentials in the HTTP Request Body for /flows only allowed for API Version v2? General	1	92	2 October 2023
Flow credentials cannot be decrypted General	9	2366	31 May 2022
Decrypting node-red credentials file General	2	272	1 April 2023
Credentials security vulnerability General security	23	205	27 August 2024

What encryption method is used to encrypt Flow Credentials in order to trigger flows via HTTP API?

Related topics