Now that the encryption implementation is using Node's crypto module, it should be pretty simple to allow Buffer or Uint8Array instances to be used as encryption keys: as far as I can tell, the only changes that would be needed would be:
Change the types on the encryptionKey parameters to encrypt and decrypt in utils/crypto.ts
Change the type of secret in SessionOptions.
Slight tweak to the code that checks whether a secret was passed in without an ID, which currently just checks for strings but would also have to check whether secret instanceof Uint8Array. (Note that Buffer is a subclass of Uint8Array so that check would be sufficient for both types).
I've looked through the Node.js implementation of pbkdf2Sync and it seems to use the entire string, not just the first N characters of the string, as a source of entropy. Which means that this won't (AFAICT) be a security improvement, just a nice-to-have feature, because converting a hex-encoded string into a byte array will still produce exactly the same amount of entropy to feed into the PBKDF2 function. So I considered not making this feature request. In the end, though, I decided to make the request, because the amount of work it will take is minimal and it will smooth out the DX for some developers. For example, if someone uses a secret that they read from a file rather than from an environment variable, being able to pass a Buffer or a Uint8Array will mean they can just pass the results from fsPromises.readFile(secretFilename) directly into handleSession, without needing to have any file encoding. Which in turn means that they can create their secret file by simply doing dd if=/dev/random of=secret.bin bs=32 count=1 and not have to worry about encoding the file to a valid string at all.
Now that the encryption implementation is using Node's
cryptomodule, it should be pretty simple to allow Buffer or Uint8Array instances to be used as encryption keys: as far as I can tell, the only changes that would be needed would be:encryptionKeyparameters toencryptanddecryptinutils/crypto.tssecretinSessionOptions.secret instanceof Uint8Array. (Note that Buffer is a subclass of Uint8Array so that check would be sufficient for both types).I've looked through the Node.js implementation of
pbkdf2Syncand it seems to use the entire string, not just the first N characters of the string, as a source of entropy. Which means that this won't (AFAICT) be a security improvement, just a nice-to-have feature, because converting a hex-encoded string into a byte array will still produce exactly the same amount of entropy to feed into the PBKDF2 function. So I considered not making this feature request. In the end, though, I decided to make the request, because the amount of work it will take is minimal and it will smooth out the DX for some developers. For example, if someone uses a secret that they read from a file rather than from an environment variable, being able to pass a Buffer or a Uint8Array will mean they can just pass the results fromfsPromises.readFile(secretFilename)directly intohandleSession, without needing to have any file encoding. Which in turn means that they can create their secret file by simply doingdd if=/dev/random of=secret.bin bs=32 count=1and not have to worry about encoding the file to a valid string at all.