title: Nodejs createCipher vs createCipheriv
body: <p>I am currently trying to encrypt data at rest with NodeJS, I have read in the Node API docs that <code>createCipher</code> is not <a href="https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password" rel="noreferrer">recommended</a>.</p>
  
  <blockquote>
    <p>The implementation of crypto.createCipher() derives keys using the
    OpenSSL function EVP_BytesToKey with the digest algorithm set to MD5,
    one iteration, and no salt. The lack of salt allows dictionary attacks
    as the same password always creates the same key. The low iteration
    count and non-cryptographically secure hash algorithm allow passwords
    to be tested very rapidly.</p>
    
    <p>In line with OpenSSL's recommendation to use pbkdf2 instead of
    EVP_BytesToKey it is recommended that developers derive a key and IV
    on their own using crypto.pbkdf2() and to use crypto.createCipheriv()
    to create the Cipher object.</p>
  </blockquote>
  
  <p>Is <code>createCipher</code> still a viable and secure way to encrypt data at rest?  Should this method be considered deprecated?
  Is it feasible for a well informed attacker to potentially decrypt data? </p>
  
  <p>Should a solution using <code>createCipheriv</code> always be preferred over <code>createCipher</code>?</p>
  
  <p>Any other details or recommendations appreciated.</p>