Weak KDF iterations (ARCH6116)
Esta página aún no está disponible en tu idioma.
Key ruby.security.weak-kdf-iterations · Severity warning · Category security · CWE CWE-916
Using a password KDF with too-low iteration/cost, or a fast hash for password storage, weakens resistance to brute-force attacks.
Incorrect
Section titled “Incorrect”OpenSSL::PKCS5.pbkdf2_hmac(password, salt, 1_000, 32, "sha256")Correct
Section titled “Correct”OpenSSL::PKCS5.pbkdf2_hmac(password, salt, 600_000, 32, "sha256")Raise the iteration/cost factor to current recommended levels, or use a password-specific KDF like bcrypt/scrypt/Argon2.