AzelusLightvale-ComfyUI-ARG-Toolkit/web/docs/SymmetricEncryptDecrypt.md

Symmetric Encrypt/Decrypt

Encrypts or decrypts data using a variety of standard symmetric ciphers and modes. This node is a wrapper around the cryptography library.

Source library: cryptography

Overview

This is a flexible, general-purpose node for performing symmetric encryption. It allows you to choose from a wide range of algorithms (like AES, ChaCha20) and modes of operation (like CBC, GCM, CTR) to fit different cryptographic needs.

Parameters

• text: The BYTESLIKE data to be encrypted or decrypted.
• key: The encryption key as a BYTESLIKE object. The required size depends on the chosen algorithm.
• iv: The initialization vector or nonce as a BYTESLIKE object. For XTS mode, this is the tweak. Not used by all algorithms/modes (e.g., ECB, stream ciphers).
• algorithm: The symmetric algorithm to use (e.g., AES, ChaCha20, TripleDES).
• modes: The cipher mode of operation (e.g., CBC, GCM, CTR).
• algorithm: The symmetric algorithm to use (e.g., AES, ChaCha20). Several legacy algorithms like TripleDES and Blowfish are supported but considered deprecated.
• modes: The cipher mode of operation (e.g., CBC, GCM, CTR). Legacy modes like OFB and CFB are supported but considered deprecated.
• mode: Toggles between Encrypt and Decrypt.
• tag: (Optional) For GCM decryption, this is the BYTESLIKE authentication tag that must be provided to verify the ciphertext's integrity and authenticity.
• min_tag_length: (Optional) For GCM, the minimum acceptable tag length during decryption.
• nonce: (Optional) A BYTESLIKE nonce, used specifically for ChaCha20 in this implementation.

Outputs

• output: The resulting ciphertext (on encryption) or plaintext (on decryption) as a BYTESLIKE object.
• tag: When using GCM mode for encryption, this output provides the generated authentication tag as a BYTESLIKE object. This tag is required for decryption.

Algorithm and Mode Compatibility

The cryptography library will raise an error if an incompatible algorithm and mode are selected. The following table provides a general guide. Items marked with (D) are deprecated according to the cryptography library and should be avoided for any serious projects.

Algorithm	CBC	CTR	OFB (D)	CFB (D)	CFB8 (D)	GCM	XTS	ECB	None
AES	✔	✔	✔	✔	✔	✔	✔	✔	❌
AES128	✔	✔	✔	✔	✔	✔	❌	✔	❌
AES256	✔	✔	✔	✔	✔	✔	❌	✔	❌
Camellia (D)	✔	✔	✔	✔	✔	❌	❌	✔	❌
ChaCha20	❌	❌	❌	❌	❌	❌	❌	❌	✔
TripleDES (D)	✔	✔	✔	✔	✔	❌	❌	✔	❌
SM4	✔	✔	✔	✔	❌	❌	❌	✔	❌
ARC4 (D)	❌	❌	❌	❌	❌	❌	❌	❌	✔
Blowfish (D)	✔	✔	✔	✔	❌	❌	❌	✔	❌
CAST5 (D)	✔	✔	✔	✔	❌	❌	❌	✔	❌
SEED (D)	✔	✔	✔	✔	❌	❌	❌	✔	❌
IDEA (D)	✔	✔	✔	✔	❌	❌	❌	✔	❌

Notes:

• Key/IV Types: All key and IV inputs must be BYTESLIKE objects of the correct length for the chosen algorithm/mode. Use the Random Nonce Generator node to create secure random values.
• Stream Ciphers: Stream ciphers like ChaCha20 and ARC4 do not use a block mode; select None.
• GCM: GCM is an authenticated mode and only works with AES in this implementation. It provides both confidentiality and integrity.
• ECB: Electronic Codebook mode is insecure for most uses and should be avoided. It does not use an IV.
• Padding: Block ciphers in modes like CBC and ECB require padding to handle messages that are not a multiple of the block size. Use AES Key Wrap With Padding to pad keys to the appropriate length.

Deprecation Warning: As of cryptography 47.0.0, several legacy primitives were moved to a decrepit module. This includes algorithms like ARC4, Blowfish, CAST5, IDEA, SEED, TripleDES, and Camellia, as well as modes like OFB, CFB, and CFB8. These are considered insecure or sub-optimal and are only provided for compatibility with legacy systems. Users are encouraged to use AES (with GCM or CTR mode) or ChaCha20 for modern applications. For more information, check the latest documentations over at https://cryptography.io/en/47.0.0/.