Weak KDF iterations (ARCH2116)

Key python.security.weak-kdf-iterations · Severity warning · Category security · CWE CWE-916

Using too few iterations or a fast hash in a password KDF weakens resistance to brute-force attacks. Use an adequate cost factor.

Incorrect

import hashlib

def hash_password(pw, salt):
    return hashlib.pbkdf2_hmac("sha256", pw, salt, 1000)

Correct

import hashlib

def hash_password(pw, salt):
    return hashlib.pbkdf2_hmac("sha256", pw, salt, 600_000)

Fix

Use a sufficiently high iteration count, or switch to a password hashing algorithm like Argon2, scrypt, or bcrypt.