deepal / node-dukpt Goto Github PK

View Code? Open in Web Editor NEW

27.0 3.0 21.0 602 KB

Node JS Library for Derived Unique Key Per Transaction (DUKPT) Encryption 💳🔑🛡

Home Page: https://jsblog.insiderattack.net/dukpt-derived-unique-key-per-transaction-with-node-js-72a6642ce89

License: MIT License

JavaScript 100.00%

dukpt-encryption aes node-dukpt dukpt encryption payments security javascript nodejs decryption

node-dukpt's Introduction

node-dukpt

Derived Unique Key Per Transaction (DUKPT) Encryption with NodeJS

This the NodeJS implementation of DUKPT based on the vanilla javascript implementation of IDTech DUKPT encryption/decryption. This module provides Dukpt encryption using either 3DES or AES schemes.

Please note that AES encryption/decryption is currently only supported with NodeJS versions 6.x.x and above due to few limitations which will be addressed soon in a next release.

Don't hesitate to report any bugs in the Github Repository!. Many thanks to @jamiesoncj for providing resources.

Prerequisites

Node v12.0.0 or above

Installing

npm install dukpt --save

Using DUKPT

Initialize DUKPT by providing BDK and KSN:

const Dukpt = require('dukpt');

const encryptionBDK = '0123456789ABCDEFFEDCBA9876543210';
const ksn = 'FFFF9876543210E00008';
const keyMode = 'datakey'; // optional: defaults to 'datakey'
const plainTextCardData = '%B5452310551227189^DOE/JOHN      ^08043210000000725000000?';

const dukpt = new Dukpt(encryptionBDK, ksn);

After initializing, you can use dukptEncrypt and dukptDecrypt methods to encrypt/decrypt data using DUKPT.

Encrypting `ascii` data

Using 3DES,

const options = {
	inputEncoding: 'ascii', 
	outputEncoding: 'hex',
	encryptionMode: '3DES'
};
const encryptedCardData3Des = dukpt.dukptEncrypt(plainTextCardData, options);

or with AES,

const options = {
	inputEncoding: 'ascii', 
	outputEncoding: 'hex',
	encryptionMode: 'AES'
};
const encryptedCardDataAes = dukpt.dukptEncrypt(plainTextCardData, options);

Encrypting `hex` data

Using 3DES,

const options = {
	inputEncoding: 'hex',
	outputEncoding: 'hex',
	encryptionMode: '3DES'
};
const encryptedCardData3Des = dukpt.dukptEncrypt(plainTextCardData, options);

or using AES,

const options = {
	inputEncoding: 'hex',
	outputEncoding: 'hex',
	encryptionMode: 'AES'
};
const encryptedCardDataAes = dukpt.dukptEncrypt(plainTextCardData, options);

Decrypting data with `ascii` output encoding

const options = {
	outputEncoding: 'ascii',
	decryptionMode: '3DES',
	trimOutput: true
};

const decryptedCardData = dukpt.dukptDecrypt(encryptedCardData, options);

Decrypting data with `hex` output encoding

const options = {
	outputEncoding: 'hex',
	decryptionMode: '3DES',
	trimOutput: true
};

const decryptedCardData = dukpt.dukptDecrypt(encryptedCardData, options);

API

constructor Dukpt(bdk, ksn, [keyMode])

bdk

Base derivation key (BDK) for initialization

ksn

Key serial number (KSN) for initialization

See here for more information on BDK and KSN

keyMode

default: 'datakey'

Key mode for deriving session key from initial pin encryption key (IPEK). Possible values are:

datakey (default)
pinkey
mackey

Dukpt.prototype.dukptEncrypt(plainTextCardData, options) and Dukpt.prototype.dukptDecrypt(encryptedCardData, options)

options

You can use options object to provide additional options for the DUKPT encryption/decryption. This object is optional and, if you don't provide it, encryption/decryption will use the default values shipped with it.

Following listed are the available options.

Option	Possible Values	Default Value	Description
`outputEncoding`	`ascii`, `hex`	For encryption `hex`, for decryption `ascii`	Specify output encoding of encryption/decryption
`inputEncoding`	`ascii`, `hex`	For encryption `ascii`, for decryption `hex`	Specify encoding of the input data for encryption/decryption
`trimOutput` (for decryption only)	`true`, `false`	`false`	Specify whether to strip out null characters from the decrypted output
`encryptionMode` (for encryption only)	`3DES`/`AES`	`3DES`/`AES`	Specify encryption scheme for dukpt
`decryptionMode` (for decryption only)	`3DES`/`AES`	`3DES`/`AES`	Specify decryption scheme for dukpt

Tests

Tests can be run using gulp as follows:

npm run test

Roadmap

Support for DUKPT Encryption/Decryption with 3DES
Support for DUKPT Encryption/Decryption with AES

node-dukpt's People

Contributors

Stargazers

Watchers

node-dukpt's Issues

ansi implementation

hi.

what kind of ansi implementation use your library? x9.24?

thank you

node-dukpt

Hi, i would like to ask how do i specify the mode in 3DES from CBC to use ECB

Constructor not taking Keymode, Please update the code

function Dukpt(bdk, ksn) {
_classCallCheck(this, Dukpt);

    this.bdk = bdk;
    this.ksn = ksn;
    this._sessionKey = this._deriveDukptSessionKey();
}

_createClass(Dukpt, [{
    key: '_deriveDukptSessionKey',
    value: function _deriveDukptSessionKey() {
        var keyMode = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : 'datakey';

Improve documentation

Documentation is currently incomplete and confusing. This needs to be fixed.

dukpt AES not working

In dukpt.lib.js there is a check for KSN being 20 bytes regardless of encryption mode. If this check is updated to 24 to allow for the larger AES KSN then the the code gets further but the generated IPEK is incorrect. What testing was done for dukpt AES?

`yarn install` isn't creating a dist folder

After running yarn install, the dist folder for the project is missing. Since the package.json has the main pointed at dist/index.js, the build fails. I was able to temporarily get around the issue by pointing to src/index.js.

Null character cleaning also removes subsequent zeroes from hex encrypted data or doesn't clean up the entire end portion.

When decrypting some of our EMV data in TLV format, we had problems with the library removing some necessary zero characters from the card data.

Changing the regex check from /\u0000/g in removeNullCharactersFromAscii to /00+$ seems to do the trick.

this._sessionKey.replace is not a function

I'm getting this._sessionKey.replace is not a function when trying to use this library, here is my code, what am I missing:

const Dukpt = require('dukpt');

const encryptionBDK = '15235124sdfasdfas1233123';
const ksn = '1234567890123456';

const encryptedCardData = 'asdfasfasd'

const dukpt = new Dukpt(encryptionBDK, ksn);

const options = {
    outputEncoding: 'ascii',
    decryptionMode: '3DES',
    trimOutput: true
};

const decryptedCardData = dukpt.dukptDecrypt(encryptedCardData, options);
console.log(decryptedCardData)

And a full error dump:

TypeError: this._sessionKey.replace is not a function
    at Dukpt.dukptDecrypt (C:\projects\...\node_modules\←[4mdukpt←[24m\dist\lib\dukpt.lib.js:196:34)
    at Object.<anonymous> (C:\projects\...\test.js:19:33)
←[90m    at Module._compile (internal/modules/cjs/loader.js:1063:30)←[39m
←[90m    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1092:10)←[39m
←[90m    at Module.load (internal/modules/cjs/loader.js:928:32)←[39m
←[90m    at Function.Module._load (internal/modules/cjs/loader.js:769:14)←[39m
←[90m    at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:72:12)←[39m
←[90m    at internal/main/run_main_module.js:17:47←[39m

Support for CBC MAC ?

Hi there,

Fantastic library. Are there plans to support generating MACs natively within the API? It's possible currently to generate a correct MAC for payloads 8 bytes or less, using the "mackey" key type and calling dukptEncrypt, by virtue of being within a single 8-byte block. Greater than 8 bytes though, and this no longer works.

Thanks

deepal / node-dukpt Goto Github PK

node-dukpt's Introduction

node-dukpt

Derived Unique Key Per Transaction (DUKPT) Encryption with NodeJS

Prerequisites

Installing

Using DUKPT

Encrypting ascii data

Encrypting hex data

Decrypting data with ascii output encoding

Decrypting data with hex output encoding

API

constructor Dukpt(bdk, ksn, [keyMode])

bdk

ksn

keyMode

Dukpt.prototype.dukptEncrypt(plainTextCardData, options) and Dukpt.prototype.dukptDecrypt(encryptedCardData, options)

options

Tests

Roadmap

node-dukpt's People

Contributors

Stargazers

Watchers

Forkers

node-dukpt's Issues

Recommend Projects

Recommend Topics

Recommend Org

Encrypting `ascii` data

Encrypting `hex` data

Decrypting data with `ascii` output encoding

Decrypting data with `hex` output encoding