CWebCryptoAESCBCProvider Class

Authenticated AES-CBC-256 encryption provider implementing Encrypt-then-MAC using HMAC-SHA-256. Designed for legacy storage compatibility and environments requiring CBC cipher mode, with complete protection against padding oracle and bit-flipping attacks.

🏛️ AEncryptionProvider (Base Class) · 🔒 CWebCryptoEncryptionProvider (AES-GCM) · 🔌 IEncryptionProvider Interface · 📖 Encryption & SSR Security Guide

Authenticated AES-CBC Cipher

CWebCryptoAESCBCProvider derives two distinct 256-bit keys from your passphrase: one for AES-CBC and one for HMAC-SHA-256. The HMAC tag is computed over the IV and ciphertext and verified prior to CBC decryption:

import { CWebCryptoAESCBCProvider } from '@katlux/providers'

const cipher = new CWebCryptoAESCBCProvider('legacy-db-passphrase-32chars!')

// Encrypt payload
const envelope = await cipher.encrypt({
    transactionId: 'TX-49210',
    amount: 1250.00
})

console.log(envelope)
// {
//   __encrypted: true,
//   ciphertext: "8fK9...",
//   iv: "16-byte-iv...",
//   tag: "hmac-sha256-tag...",
//   alg: "AES-CBC-256+HMAC-SHA-256"
// }

// Decrypt payload
const decrypted = await cipher.decrypt(envelope)
console.log(decrypted.transactionId) // "TX-49210"