데이터 암호화 및 해싱
저장 중이거나 전송 중인 민감한 데이터를 암호화하고 사용자 비밀번호에 적절한 해싱 기법을 사용하는 방법을 학습합니다.
데이터 암호화 및 해싱은(는) CoddyKit의 무료 Node.js Backend Development Bootcamp 강의입니다. 이것은 4개 중 3번째 강의입니다. 아래에서 전체 강의를 무료로 읽을 수 있으며, 내장 코드 에디터와 24/7 AI 튜터와 함께 브라우저에서 직접 실습할 수 있습니다. 이 강의는 Node.js Backend Development Bootcamp 학습 경로의 일부이며, 진행 상황이 웹과 CoddyKit 앱에 동기화됩니다. Node.js Backend Development Bootcamp 강의에는 총 4개의 강의가 포함되어 있습니다.
이 강의의 일부는 아직 번역되지 않았으며 영어로 표시됩니다.
Data Security Essentials
Welcome to Data Encryption & Hashing! In today's digital world, protecting sensitive information is paramount. Whether it's user passwords, personal data, or financial details, securing this data is a core responsibility for any developer.
This lesson will equip you with the knowledge and tools to implement robust data protection strategies in your Node.js applications.
Encryption vs. Hashing
Before diving into techniques, let's understand two fundamental concepts:
- Encryption: A two-way process that transforms data (plaintext) into an unreadable format (ciphertext) using a key. It's reversible, meaning the ciphertext can be converted back to plaintext with the correct key.
- Hashing: A one-way process that transforms data of any size into a fixed-size string of characters (a hash value or digest). It's irreversible; you cannot get the original data back from its hash.
They serve different purposes!
Symmetric Encryption
Symmetric encryption uses the same secret key for both encrypting and decrypting data. It's fast and efficient, making it suitable for encrypting large amounts of data.
Common algorithms include AES (Advanced Encryption Standard). The key must be kept secret and securely exchanged between parties.
Node.js Symmetric Encryption
Node.js's built-in crypto module allows us to perform symmetric encryption. Here's an example using AES-256-CBC, a strong symmetric algorithm.
Note: In a real application, the encryption key should be securely generated and stored (e.g., in environment variables) and the IV should be random for each encryption.
const crypto = require('crypto');
// IMPORTANT: In production, generate this key securely and store it safely!
const ENCRYPTION_KEY = 'averysecretkeyforencryption123456'; // Must be 32 bytes for AES-256
const IV_LENGTH = 16; // For AES-256-CBC, IV is 16 bytes
function encrypt(text) {
const iv = crypto.randomBytes(IV_LENGTH);
const cipher = crypto.createCipheriv(
'aes-256-cbc',
Buffer.from(ENCRYPTION_KEY, 'utf8'),
iv
);
let encrypted = cipher.update(text, 'utf8', 'hex');
encrypted += cipher.final('hex');
// Store IV with encrypted data (e.g., as 'iv:encryptedData')
return iv.toString('hex') + ':' + encrypted;
}
function decrypt(text) {
const textParts = text.split(':');
const iv = Buffer.from(textParts.shift(), 'hex');
const encryptedText = textParts.join(':');
const decipher = crypto.createDecipheriv(
'aes-256-cbc',
Buffer.from(ENCRYPTION_KEY, 'utf8'),
iv
);
let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
decrypted += decipher.final('utf8');
return decrypted;
}
const message = 'Sensitive data for storage.';
console.log('Original:', message);
const encryptedMessage = encrypt(message);
console.log('Encrypted:', encryptedMessage);
const decryptedMessage = decrypt(encryptedMessage);
console.log('Decrypted:', decryptedMessage);Asymmetric Encryption
Asymmetric encryption, also known as public-key cryptography, uses a pair of keys: a public key and a private key.
- Public key: Can be shared with anyone. Used for encryption.
- Private key: Must be kept secret. Used for decryption.
If you encrypt data with someone's public key, only they can decrypt it with their private key. This is slower than symmetric encryption but crucial for secure communication and digital signatures.
Hashing for Passwords
When storing user passwords, NEVER encrypt them. Instead, always hash them. If an attacker gains access to your database, they would ideally only find irreversible hashes, not decryptable passwords.
A good hashing algorithm for passwords should be:
- One-way: Impossible to reverse.
- Collision-resistant: Extremely unlikely for two different inputs to produce the same hash.
- Slow: Deliberately designed to be computationally intensive to deter brute-force attacks.
Salting Passwords
To further enhance password security, we use salts. A salt is a unique, random string added to a password before it's hashed.
Why use salts?
- Prevents Rainbow Table Attacks: Without salts, attackers could pre-compute hashes for common passwords (rainbow tables).
- Unique Hashes: Even if two users have the same password, their salted hashes will be different.
The salt is usually stored alongside the hash.
Bcrypt for Password Hashing
bcrypt is a widely recommended library for hashing passwords in Node.js because it's designed to be slow and integrates salting automatically.
It handles generating a unique salt and performing multiple rounds of hashing (controlled by saltRounds, a work factor) to make brute-force attacks more difficult.
const bcrypt = require('bcrypt');
async function runBcryptExample() {
const password = 'mySecretPassword123';
const saltRounds = 10; // A higher number means more processing time
console.log('Original Password:', password);
// Hash the password with a generated salt
const hashedPassword = await bcrypt.hash(password, saltRounds);
console.log('Hashed Password:', hashedPassword);
// Compare a candidate password with the stored hash
const isMatch = await bcrypt.compare(password, hashedPassword);
console.log('Password Match (correct):', isMatch);
const wrongPassword = 'wrongPassword';
const isWrongMatch = await bcrypt.compare(wrongPassword, hashedPassword);
console.log('Password Match (wrong):', isWrongMatch);
}
runBcryptExample();Securing Data in Transit (TLS/SSL)
While encryption and hashing protect data at rest (stored in a database), it's equally important to protect data while it's moving between systems (data in transit).
TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols provide encryption for network communication. When you visit a website using HTTPS, your browser and the server use TLS/SSL to encrypt all data exchanged, preventing eavesdropping and tampering.
Check Your Understanding
Which of the following statements about encryption and hashing are TRUE?
Recap: Data Protection
Great job! You've learned the fundamentals of data encryption and hashing:
- Encryption protects sensitive data, making it reversible with a key.
- Hashing provides one-way transformation, ideal for password storage and data integrity.
- Symmetric encryption uses a single key, while asymmetric encryption uses public/private key pairs.
- Always use strong, salted hashing (like bcrypt) for passwords.
- TLS/SSL secures data in transit over networks.
Implementing these practices is vital for building secure Node.js applications!
자주 묻는 질문
“데이터 암호화 및 해싱” 강의는 무료인가요?
네 — “데이터 암호화 및 해싱” 전체 내용을 이 웹사이트에서 무료로 읽을 수 있습니다. 인터랙티브하게 실습하려면(내장 코드 에디터와 24/7 AI 튜터), CoddyKit PRO로 업그레이드하면 Node.js Backend Development Bootcamp 강의 전체를 잠금 해제할 수 있습니다. Node.js Backend Development Bootcamp 강의에는 총 4개의 강의가 포함되어 있습니다.
“데이터 암호화 및 해싱”에서 뭘 배우나요?
저장 중이거나 전송 중인 민감한 데이터를 암호화하고 사용자 비밀번호에 적절한 해싱 기법을 사용하는 방법을 학습합니다. 브라우저에서 직접 실행하는 실습 코드로 Node.js Backend Development Bootcamp을(를) 배우며, 24/7 AI 튜터가 강의를 진행하면서 질문에 답변해줍니다.
Node.js Backend Development Bootcamp을(를) 시작하는 데 경험이 필요한가요?
사전 경험은 필요하지 않습니다. CoddyKit의 Node.js Backend Development Bootcamp은(는) 초급자부터 고급 학습자까지를 위해 구성되어 있으므로, 여기서 시작하거나 처음부터 시작할 수 있으며 자신의 속도대로 진행할 수 있습니다. 이것은 4개 중 3번째 강의입니다.
“데이터 암호화 및 해싱” 강의는 얼마나 걸리나요?
대부분의 CoddyKit 강의는 약 5~10분이 소요됩니다. 각 강의는 간결하고 인터랙티브하여 꾸준한 진행이 가능하며, 웹과 앱에서 중단한 부분부터 바로 시작할 수 있습니다.
이 Node.js Backend Development Bootcamp 강의에서 코드를 작성하고 실행할 수 있나요?
네. 모든 Node.js Backend Development Bootcamp 강의에는 내장 코드 에디터가 포함되어 있으므로, 브라우저에서 바로 실제 코드를 작성하고 실행한 후 즉시 AI 피드백을 받을 수 있습니다 — 로컬 설정이 필요 없습니다.