title: Is it necessary to use key derivation when using Node's 'crypto' module?
body: <p>I need to implement symmetric encryption using a user's passphrase in a NodeJS application. When using <a href="https://nodejs.org/api/crypto.html#crypto_crypto_createcipheriv_algorithm_key_iv_options" rel="nofollow noreferrer"><code>crypto.createCipheriv()</code></a>, do I need to perform some sort of key derivation on the passphrase to obtain a value for the <code>key</code> parameter, or is it sufficient to just pass the user's passphrase as-is and this is taken care of by the implementation?</p>