[FEATURE] Export NexoCrypto utility

[naseemkullah]

Currently, when handling encrypted terminal display/event notifications, we need to re-implement low-level decryption logic. To simplify integration and avoid maintaining custom cryptographic implementations, please provide an officially supported utility for decrypting these messages.

Current Workaround:

We maintain our own NexoCrypto implementation, which adds overhead and potential security risks compared to an officially provided solution.

Would appreciate any insights on feasibility!

[naseemkullah]

BTW - this was flagged when copy pasting the utility into our code base

adyen-node-api-library/src/security/nexoCrypto.ts

Lines 97 to 99 in 29a7290

	const cipher = mode === Modes.ENCRYPT
	? createCipheriv("aes-256-cbc", dk.cipherKey, actualIV)
	: createDecipheriv("aes-256-cbc", dk.cipherKey, actualIV);

[gcatanese]

Thank you for flagging this, and apologies for the late response.

Why can't you use NexoCrypto.encrypt and NexoCrypto.decrypt functions? I'd like to have more context on what you need and why, so we can improve the library accordingly if necessary.

Thank you for pointing out the security warning. We'll investigate what should be done.

[naseemkullah]

Why can't you use NexoCrypto.encrypt and NexoCrypto.decrypt functions? I'd like to have more context on what you need and why, so we can improve the library accordingly if necessary.

Use case is https://docs.adyen.com/point-of-sale/design-your-integration/choose-your-architecture/local/protect/?programming_language=js#full-code-samples - just decrypting encrypted terminal events. Is NexoCrypto exported from this SDK and if so could it cover my use case?

Thanks for looking into this!

[gcatanese]

I see. I think the code snippet on our doc is old and obsolete, you should be able to use the Node library already:

• NexoCrypto.encrypt: it encrypts a saleToPoiMessageJson using AES-256-CBC and generates an HMAC for message integrity. It returns a SaleToPOISecuredMessage that includes the encrypted payload and security metadata.
• NexoCrypto.decrypt: it decrypts a SaleToPOISecuredMessage and validates its integrity using an HMAC.

Can you try and let me know?
I'll get our teams to update the Docs.

[github-actions]

This issue has been automatically marked as stale due to inactivity and will be closed in 7 days if no further activity occurs.

[naseemkullah]

perfect - this works great and thanks for letting the doc team know!