Node.js crypto.createSign method — A Comprehensive Guide

In Node.js, the crypto.createSign() method is a built-in method in the crypto module that is used to create a signing object that allows you to generate digital signatures for your data. The role of digital signatures is to ensure the authenticity and integrity of the data which can be a message, software, or digital document.

Before we go into the details of how to use the createSign() method, let’s quickly revise what digital signatures are so you know and understand when to use them and what’s actually happening in the background.

What is a Digital Signature?

The purpose of a digital signature is to ensure that the data is not altered in any way during transmission AND also to provide proof of the sender’s identity. Both these aspects verify the authenticity and integrity of the digital data that is being transmitted.

Let’s get a quick overview of the process where Bob is the sender and Alice is the receiver.

1. Bob hashes the digital data, which he wants to send into a fixed-length digest.
2. He encrypts the hash using his private key (that only he has access to) to generate a digital signature and sends it to Alice.
3. Bob’s public key is already publicly available; Alice uses this public key to decrypt the data Bob sent. Only Bob’s public key can be used to decrypt a message that has been encrypted using his private key—so his identity is confirmed.
4. Alice uses the same hash function to generate a hash of the data. She then compares the hash digest sent by Bob to the hash she generated—if both are the same, it means that the data was not compromised or corrupted during transmission.

Now back to our main focus, the createSign() method.

How to use the createSign() method?

The createSign() method is commonly used in scenarios where data integrity is crucial and where you want to be protected against anyone who might falsely deny performing a particular action like signing transactions on a blockchain.

Let’s create a digital signature for a message. Here’s an example 👇🏼

const crypto = require('crypto');

const message = 'This is a message to be signed';

// Create a sign object using the 'RSA-SHA256' algorithm
const sign = crypto.createSign('RSA-SHA256');

// Update the sign object with the message to be signed
sign.update(message);

// Generate the private key
const privateKey = '-----BEGIN RSA PRIVATE KEY-----\n' +
                   'MIIEpAIBAAKCAQEA6DgHBlcjg+zUvkVq3R5jFcq0f0mvj8YtfHr5r5f5x5j5v5r5\n' +
                   'f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5\n' +
                   'x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5\n' +
                   'j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5\n' +
                   'v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5\n' +
                   'r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5f5x5j5v5r5\n' +
                   '-----END RSA PRIVATE KEY-----\n';

// Sign the message using the private key
const signature = sign.sign(privateKey, 'hex');
console.log(signature); // Outputs the digital signature

Explanation

• Import the crypto module.
• Define a message that we want to sign.
• Create a sign object using the crypto.createSign() method, passing in the algorithm we want to use for the signature. In this case, we are using the RSA-SHA256 algorithm.
• Update the sign object with the message we want to sign using the sign.update() method.
• Generate a private key, which is used to sign the message. The private key is a string in PEM format, which is a standard format for storing cryptographic keys.
• Use the sign.sign() method to sign the message using the private key. The first argument passed to this method is the private key, and the second argument is the encoding of the output signature. In this example, we are using the ‘hex’ encoding, which will output the signature as a hexadecimal string. The sign() method can output the signature in various formats:
  • 'hex': Hexadecimal string
  • 'base64': Base64 encoded string
  • 'buffer': Binary buffer

Please note that it is highly recommended that you do not hardcode the private key in the code, which should be kept secret and protected.

Once we have the signature, we can then use the public key to verify the authenticity of the message by using the crypto.createVerify() method along with the verify.update() and verify.verify() method.

This way you can ensure that the message has not been tampered with and is coming from a trusted source.

Related Reading:

• Detailed Introduction to Crypto Algorithms
• What is Node.js Crypto Module and How to Use It (Complete Guide)
• Node.js crypto.createHash() method — A Comprehensive Guide

FAQs