|
26 | 26 | * 1. PBKDF2 Examples: - Parent Classification: Password-Based Key Derivation |
27 | 27 | * Function (PBKDF). - SAST: * pbkdf2DerivationBasic: Uses PBKDF2WithHmacSHA256 |
28 | 28 | * with 10,000 iterations - acceptable if parameters meet current standards. * |
29 | | - * pbkdf2LowIteration: Uses only 10 iterations – flagged as insecure due to |
| 29 | + * pbkdf2LowIteration: Uses only 10 iterations, flagged as insecure due to |
30 | 30 | * insufficient iteration count. * pbkdf2HighIteration: Uses 1,000,000 |
31 | | - * iterations – secure (though performance may be impacted). * pbkdf2HmacSHA1: |
32 | | - * Uses PBKDF2WithHmacSHA1 – flagged as weaker compared to SHA-256, though |
| 31 | + * iterations - secure (though performance may be impacted). * pbkdf2HmacSHA1: |
| 32 | + * Uses PBKDF2WithHmacSHA1 - flagged as weaker compared to SHA-256, though |
33 | 33 | * sometimes seen in legacy systems. * pbkdf2HmacSHA512: Uses |
34 | | - * PBKDF2WithHmacSHA512 – classified as secure. |
| 34 | + * PBKDF2WithHmacSHA512 - classified as secure. |
35 | 35 | * |
36 | 36 | * 2. Scrypt Examples: - Parent Classification: Memory-Hard Key Derivation |
37 | | - * Function. - SAST: * scryptWeak: Uses weak parameters (n=1024, r=1, p=1) – |
| 37 | + * Function. - SAST: * scryptWeak: Uses weak parameters (n=1024, r=1, p=1) - |
38 | 38 | * flagged as insecure. * scryptStrong: Uses stronger parameters (n=16384, r=8, |
39 | | - * p=1) – considered secure. |
| 39 | + * p=1) - considered secure. |
40 | 40 | * |
41 | 41 | * 3. Argon2 Examples: - Parent Classification: Memory-Hard Key Derivation |
42 | 42 | * Function (Argon2id). - SAST: * argon2Derivation: Uses moderate memory and |
43 | | - * iterations – considered secure. * argon2HighMemory: Uses high memory (128MB) |
44 | | - * and more iterations – secure, though resource intensive. |
| 43 | + * iterations - considered secure. * argon2HighMemory: Uses high memory (128MB) |
| 44 | + * and more iterations - secure, though resource intensive. |
45 | 45 | * |
46 | 46 | * 4. Insecure Raw Hash Derivation: - Parent Classification: Raw Hash Usage for |
47 | 47 | * Key Derivation. - SAST: Using a single SHA-256 hash as a key and then using |
|
0 commit comments