How to fix Error: Key derivation failed (pbkdf2/scrypt/bcrypt operation failed) in Node.js

const crypto = require('crypto');

// PBKDF2 - Ensure all parameters are valid
crypto.pbkdf2('password', 'salt', 100000, 64, 'sha512', (err, derivedKey) => {
  if (err) {
    console.error('PBKDF2 failed:', err.message);
    // Check parameter types and values
    console.log('Password type:', typeof 'password');
    console.log('Salt type:', typeof 'salt');
    return;
  }
  console.log('Key derived successfully:', derivedKey.toString('hex'));
});

// Use Buffer for salt (recommended)
const salt = crypto.randomBytes(16);
crypto.pbkdf2('password', salt, 100000, 64, 'sha512', (err, derivedKey) => {
  if (err) throw err;
  console.log('Success with Buffer salt');
});

const crypto = require('crypto');

// PBKDF2 - Reduce iterations if experiencing timeouts
const ITERATIONS_DEVELOPMENT = 10000;  // Lower for dev
const ITERATIONS_PRODUCTION = 100000;  // Higher for production

const iterations = process.env.NODE_ENV === 'production'
  ? ITERATIONS_PRODUCTION
  : ITERATIONS_DEVELOPMENT;

crypto.pbkdf2('password', salt, iterations, 64, 'sha512', callback);

// Scrypt - Use more conservative parameters
const scryptOptions = {
  N: 16384,    // CPU/memory cost (default: 16384, lower for constrained environments)
  r: 8,        // Block size
  p: 1,        // Parallelization
  maxmem: 32 * 1024 * 1024  // 32 MB max memory
};

crypto.scrypt('password', salt, 64, scryptOptions, (err, derivedKey) => {
  if (err) {
    console.error('Scrypt failed:', err.message);
    return;
  }
  console.log('Success');
});

// Bcrypt - Use lower rounds for better performance
const bcrypt = require('bcrypt');
const saltRounds = 10;  // Default, can reduce to 8-9 for faster operation

bcrypt.hash('password', saltRounds, (err, hash) => {
  if (err) throw err;
  console.log('Hash:', hash);
});

# Remove existing installation
npm uninstall bcrypt

# Clear npm cache
npm cache clean --force

# Reinstall with build tools available
npm install bcrypt

# On Linux/Mac, ensure build tools are installed
# Ubuntu/Debian:
sudo apt-get install build-essential python3

# macOS:
xcode-select --install

# Windows: Install windows-build-tools
npm install --global windows-build-tools

npm uninstall bcrypt
npm install bcryptjs

// Change from:
// const bcrypt = require('bcrypt');

// To:
const bcrypt = require('bcryptjs');

// API is identical, but pure JS (slower, no native dependencies)

// Test scrypt availability
const crypto = require('crypto');

if (typeof crypto.scrypt === 'function') {
  console.log('✓ Scrypt is available');
} else {
  console.log('✗ Scrypt is NOT available - Node.js may be compiled without scrypt');
}

// Test PBKDF2 availability
if (typeof crypto.pbkdf2 === 'function') {
  console.log('✓ PBKDF2 is available');
}

// Check Node.js version
console.log('Node.js version:', process.version);

# Reinstall Node.js from official binaries (not distro packages)
# Using nvm (recommended):
nvm install --lts
nvm use --lts

# Or download from nodejs.org
# Avoid using system package managers for Node.js if possible

# Check compatibility
npm list bcrypt

# Upgrade to latest compatible version
npm update bcrypt

# docker-compose.yml
services:
  app:
    image: node:18
    mem_limit: 512m  # Increase from default
    memswap_limit: 512m
    environment:
      - NODE_OPTIONS=--max-old-space-size=384

# Docker run command
docker run --memory="512m" --memory-swap="512m" your-image

# deployment.yaml
spec:
  containers:
  - name: app
    resources:
      limits:
        memory: "512Mi"
      requests:
        memory: "256Mi"
    env:
    - name: NODE_OPTIONS
      value: "--max-old-space-size=384"

# Check current limits
ulimit -a

# Increase memory limit (Linux)
ulimit -m unlimited
ulimit -v unlimited

# For production, set in /etc/security/limits.conf
* soft memlock unlimited
* hard memlock unlimited

const crypto = require('crypto');

async function deriveKey(password, salt) {
  return new Promise((resolve, reject) => {
    // Try scrypt first (most secure)
    crypto.scrypt(password, salt, 64, { N: 16384 }, (err, key) => {
      if (err) {
        console.warn('Scrypt failed, falling back to PBKDF2:', err.message);

        // Fallback to PBKDF2
        crypto.pbkdf2(password, salt, 100000, 64, 'sha512', (err2, key2) => {
          if (err2) {
            reject(new Error(`Key derivation failed: ${err2.message}`));
          } else {
            resolve(key2);
          }
        });
      } else {
        resolve(key);
      }
    });
  });
}

// Usage with try-catch
try {
  const salt = crypto.randomBytes(16);
  const key = await deriveKey('myPassword', salt);
  console.log('Key derived successfully');
} catch (error) {
  console.error('All key derivation methods failed:', error);
  // Handle gracefully - maybe use a different authentication method
}

const metrics = {
  pbkdf2Failures: 0,
  scryptFailures: 0,
  bcryptFailures: 0
};

function trackCryptoFailure(method, error) {
  metrics[`${method}Failures`]++;
  console.error(`[${method}] Failure #${metrics[`${method}Failures`]}: ${error.message}`);

  // Alert if failures exceed threshold
  if (metrics[`${method}Failures`] > 10) {
    // Send alert to monitoring system
  }
}